# Winlogbeat Sysmon Configuration Registry fields seems to map the wrong value of the registry

**URL:** <https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/277879>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [July 5, 2021, 7:45pm UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/277879 "2021-07-05T19:45:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [July 5, 2021, 7:45pm UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/277879/1 "2021-07-05T19:45:55Z")

</div>

Hello,

Second try.. ([Winlogbeat Sysmon Configuration Registry fields seems to map the wrong value of the registry](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/273733))

Just noticed something weird with Sysmon configuration in 7.11 (registry events)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/f/8f0a8657d2691401f25bc192344d4d1874de557f.png)

As you can see, the actual value of the registry key is in `winlog.event_data.Details` while imho this should be in `registry.value` ? or at least the part within paranthese..

In a Sysmon event this is set under details:

```auto
Registry value set:
RuleName: Suspicious,ImageBeginWithBackslash
EventType: SetValue
UtcTime: 2021-05-22 14:00:07.137
ProcessGuid: {afbc1ce0-0e67-60a9-b709-00000000c900}
ProcessId: 13248
Image: C:\WINDOWS\regedit.exe
TargetObject: HKLM\SOFTWARE\Digipolis\BeheerCredProv\LinkCaption
Details: Wachtwoord vergeten of account geblokkeerd?

```

In the above example `registry.value` should be `Wachtwoord vergeten of account geblokkeerd?` ?

But in 7.11 `registry.value` is set to `LinkCaption` ..

Best regards,

Willem

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 2, 2021, 9:46pm UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/277879/2 "2021-08-02T21:46:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.