Use the Get Registry Key Information SOAR action to get registry key information based on the selected alert or device.

  • This action can be run from an alert or a device.
  • When the action Get Registry Key Information is run, a popup window displays informing you that the process has started.
  • Registry key information is added to the Registry Key Information table in the alert or device record.
  • Work notes are added for a process started, a process completed successfully, API failures, and exception scenarios.