# Winlogbeat Sysmon Configuration Registry fields seems to map the wrong value of the registry **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [August 16, 2021, 9:30am UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/281521 "2021-08-16T09:30:13Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Post date:** [August 16, 2021, 9:30am UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/281521/1 "2021-08-16T09:30:14Z")
Third attempt to escalate this... > [@Winlogbeat Sysmon Configuration Registry fields seems to map the wrong value of the registry](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/273733): > > Hello, Just noticed something weird with Sysmon configuration in 7.11 (registry events) As you can see, the actual value of the registry key is in winlog.event\_data.Details while imho this should be in registry.value? or at least the part within paranthese.. In a Sysmon event this is set under details: Registry value set: RuleName: Suspicious,ImageBeginWithBackslash EventType: SetValue UtcTime: 2021-05-22 14:00:07.137 ProcessGuid: {afbc1ce0-0e67-60a9-b709-00000000c900} ProcessId: 1… > [@Winlogbeat Sysmon Configuration Registry fields seems to map the wrong value of the registry](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/277879): > > Hello, Second try.. ([Winlogbeat Sysmon Configuration Registry fields seems to map the wrong value of the registry](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/273733)) Just noticed something weird with Sysmon configuration in 7.11 (registry events) As you can see, the actual value of the registry key is in winlog.event\_data.Details while imho this should be in registry.value ? or at least the part within paranthese.. In a Sysmon event this is set under details: Registry value set: RuleName: Suspicious,ImageBeginWithBackslash EventTy… Can someone please verify and confirm this bug? Same issue in 7.13.1.. Willem ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [August 16, 2021, 11:56am UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/281521/2 "2021-08-16T11:56:54Z")
That looks like a bug to me. Please open a bug for it. The test data for the module looks wrong. IIUC the value should be 0x00000004. > ---
**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Post date:** [August 16, 2021, 7:42pm UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/281521/3 "2021-08-16T19:42:47Z")
Thanks for confirming @andrewkroh > > > \- Version: 7.13.1 > \- Operating System: Red Hat 8 / All Windows Versions > \- Discu…ss Forum URL: > - https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/281521 > - https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/273733 > - https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/277879 > \- Steps to Reproduce: Enable Sysmon registry events and index them with Winlogbeat Sysmon module > > > https://github.com/elastic/beats/blob/ee5ed90dec9e1c8091f7cddf88ba50198668714b/x-pack/winlogbeat/module/sysmon/test/testdata/sysmon-11-registry.evtx.golden.json#L39-L46 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 13, 2021, 9:42pm UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/281521/4 "2021-09-13T21:42:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.