Registry Key Check - Relevance Issue

Greetings All,

I am trying to create an analysis to check the status of our security apps. One of the checks I would like to do involves looking at a specific registry key for Netskope. I can find the registry path using relevance, but I am unable to reference the values inside the path.

This is the base relevance I am working from. This works correctly.

(exists keys whose (exists values "DisplayName" whose (it as string contains "Google Chrome") of it) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of native registry)

image

And here is the new relevance I have created to find the Netskope key/value I am trying to verify:

(exists keys whose (exists values "NpaStatus" whose (it as string contains "Disconnected") of it) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\NetSkope\NpaTunnel" of native registry

image

I have confirmed that the value exists in the registry of the system I am testing on.

Any assistance or suggestions you can provide would be greatly appreciated.

Thank you,
_mxg

I think the issue has to do with the fact that you’re looking for keys within the ‘NpaTunnel’ key (but that key has the value you’re looking for).

Try something like:

(exists keys whose (name of it = "NpaTunnel" AND exists values "NpaStatus" whose (it as string contains "Disconnected") of it) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\NetSkope" of native registry)

4 Likes

Thank you Aram! That’s what I was missing. Your relevance worked, but I was also able to correct my original relevance and that now gives me the results I want. I was just too far down the registry chain. :upside_down_face:

(exists keys whose (exists values "NpaStatus" whose (it as string contains "Disconnected") of it) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\NetSkope" of native registry

image

Many thanks,
_mxg

2 Likes