Get the registry key information of the selected device, or the device associated with the selected alert.

  • This action can be run from an alert and from a device. It can be run on only one alert or device at a time.
  • This action can be performed on Windows devices only. If the action is performed on devices other than Windows, the error message: Action can only be performed on devices with WINDOWS OS displays.
  • This action can be performed on Carbon Black Cloud devices only. If the action is performed on devices other than from Carbon Black Cloud, the error message: Cannot complete action. Asset does not exist displays.
  • When the Create a Registry Key SOAR action is performed, a registry key is created at the specified path.
  • If you attempt to create a registry key with the same name at the same path, an error response is returned.
  • Registry keys cannot be created as an immediate child for the parent keys HKEY_USERS and HKEY_LOCAL_MACHINE.