Schema: Windows Registry
Windows registry operations including hives, keys, values, and data types.
12 fields available
[← Back to Schema Field Reference](schema-field-reference-guide.md)
registry.data.reg_binary_data
registry.data.reg_binary_dataRegistry value data when type_id is REG_BINARY or REG_NONE (OCSF win/reg_value.reg_binary_data). Hex-encoded.
Providers: crowdstrike,microsoft_defender
registry.data.reg_integer_data
registry.data.reg_integer_dataRegistry value data when type_id is REG_DWORD or REG_QWORD (OCSF win/reg_value.reg_integer_data). Stored as string to preserve cross-provider compatibility.
Providers: crowdstrike,microsoft_defender
registry.data.reg_string_data
registry.data.reg_string_dataRegistry value data when type_id is REG_SZ, REG_EXPAND_SZ, or REG_LINK (OCSF win/reg_value.reg_string_data).
Providers: crowdstrike,sentinel_one,microsoft_defender,elastic
registry.data.reg_string_list_data
registry.data.reg_string_list_dataRegistry value data when type_id is REG_MULTI_SZ (OCSF win/reg_value.reg_string_list_data).
Providers: Not specified
registry.data.strings
registry.data.stringsDEPRECATED: Use type-specific OCSF fields (registry.data.reg_string_data, registry.data.reg_integer_data, registry.data.reg_binary_data, registry.data.reg_string_list_data) instead. Legacy catch-all for registry value data.
Providers: crowdstrike,sentinel_one,microsoft_defender,elastic
registry.data.type
registry.data.typeRegistry value type. Values may be string names (e.g., SZ, DWORD, QWORD) or numeric codes (e.g., 1, 4).
Providers: crowdstrike,microsoft_defender,elastic
registry.hive
registry.hiveAbbreviated name for the registry hive. Known values: HKLM, HKEY_USERS, APPLICATION_HIVE.
Providers: crowdstrike,microsoft_defender
registry.key
registry.keyHive-relative path of the registry key.
Providers: crowdstrike,sentinel_one,microsoft_defender,elastic
registry.path
registry.pathFull registry path including hive, key, and value name.
Providers: crowdstrike,sentinel_one,microsoft_defender,elastic
registry.prev_reg_key
registry.prev_reg_keyRegistry key before the mutation (OCSF win/reg_value.prev_reg_key).
Providers: microsoft_defender
registry.prev_reg_value
registry.prev_reg_valueRegistry value name before the mutation (OCSF win/reg_value.prev_reg_value).
Providers: microsoft_defender
registry.value
registry.valueName of the registry value written or modified.
Providers: crowdstrike,sentinel_one,microsoft_defender,elastic
Updated 12 days ago