# Issue monitoring registry key using elastic agent (File Integrity Monitoring integration)

**URL:** <https://discuss.elastic.co/t/issue-monitoring-registry-key-using-elastic-agent-file-integrity-monitoring-integration/369086>\
**Category:** Endpoint Security\
**Created:** [October 18, 2024, 9:15pm UTC](https://discuss.elastic.co/t/issue-monitoring-registry-key-using-elastic-agent-file-integrity-monitoring-integration/369086 "2024-10-18T21:15:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ganrt](https://avatars.discourse-cdn.com/v4/letter/g/a9adbd/32.png) [@ganrt](https://discuss.elastic.co/u/ganrt)\
**Post date:** [October 18, 2024, 9:15pm UTC](https://discuss.elastic.co/t/issue-monitoring-registry-key-using-elastic-agent-file-integrity-monitoring-integration/369086/1 "2024-10-18T21:15:01Z")

</div>

Hello.  
Recently a deploy elastic stack with elastic agent and it seem to be no monitoring registry key, however if I place a folder directory it works file, however not with registry key path, any suggestion what to monitor this event registry key are really an important matter here.

{"log.level":"warn","@timestamp":"2024-10-18T21:27:26.640Z","message":"Failed to resolve symlink","component":{"binary":"auditbeat","dataset":"elastic\_agent.auditbeat","id":"audit/file\_integrity-default","type":"audit/file\_integrity"},"log":{"source":"audit/file\_integrity-default"},"service.name":"auditbeat","scanner\_id":18,"error":{"message":"CreateFile HKEY\_LOCAL\_MACHINE: The system cannot find the file specified."},"log.origin":{"file.line":101,"file.name":"file\_integrity/scanner.go"},"ecs.version":"1.6.0","log.logger":"file\_integrity","file\_path":"HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run","ecs.version":"1.6.0"}

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/d/7d20b36f0fcc76c80fa04b15ba1ea6c1b978e45f.png)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [October 18, 2024, 10:16pm UTC](https://discuss.elastic.co/t/issue-monitoring-registry-key-using-elastic-agent-file-integrity-monitoring-integration/369086/2 "2024-10-18T22:16:36Z")

</div>

Hello and welcome,

The File Integratiy Monitoring can not monitor Registry Key, that's why you got this error.

If I'm not wrong only the Elastic Defend integration looks into Registry Key.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 15, 2024, 10:17pm UTC](https://discuss.elastic.co/t/issue-monitoring-registry-key-using-elastic-agent-file-integrity-monitoring-integration/369086/3 "2024-11-15T22:17:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.