# Winlogbeat Sysmon Configuration Registry fields seems to map the wrong value of the registry

**URL:** <https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/273733>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [May 22, 2021, 5:26pm UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/273733 "2021-05-22T17:26:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [May 22, 2021, 5:26pm UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/273733/1 "2021-05-22T17:26:02Z")

</div>

Hello,

Just noticed something weird with Sysmon configuration in 7.11 (registry events)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/f/8f0a8657d2691401f25bc192344d4d1874de557f.png)

As you can see, the actual value of the registry key is in `winlog.event_data.Details` while imho this should be in `registry.value`? or at least the part within paranthese..

In a Sysmon event this is set under details:

```
Registry value set:
RuleName: Suspicious,ImageBeginWithBackslash
EventType: SetValue
UtcTime: 2021-05-22 14:00:07.137
ProcessGuid: {afbc1ce0-0e67-60a9-b709-00000000c900}
ProcessId: 13248
Image: C:\WINDOWS\regedit.exe
TargetObject: HKLM\SOFTWARE\Digipolis\BeheerCredProv\LinkCaption
Details: Wachtwoord vergeten of account geblokkeerd?

```

In the above example `registry.value` should be `Wachtwoord vergeten of account geblokkeerd?` ?

But in 7.11 `registry.value` is set to `LinkCaption`..

Best regards,

Willem

---

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [May 31, 2021, 9:17am UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/273733/2 "2021-05-31T09:17:43Z")

</div>

Anyone?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 28, 2021, 11:18am UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/273733/3 "2021-06-28T11:18:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.