- Login to the command line of the Cb Response server
- Execute this add ingress filter command with the following parameters:
- Replace "XXXXXXXX" with your API Token.
- Enter a unique alphanumeric value for "id"
- Replace the regmod_filter path with the exact path to the registry directory.
curl -vv --tlsv1.2 -XPOST -H "X-Auth-Token: XXXXXXXX" -H "Content-Type: application/json" "https://localhost/api/v1/ingress_whitelist" -k -d '
[
{
"id": "example",
"priority": 0,
"enabled": true,
"filter_on_server": true,
"track_metrics": true,
"os_mask": 7,
"global": true,
"group_ids": [],
"sensor_ids": [],
"regmod_filters": ["rxi|\\\\registry\\\\machine\\\\software\\\\example directory\\\\example subdirectory\\\\*"],
"filter_all_events": false,
"path_filters": ["*"]
}
]'