CB Protection: What does the "Open Key" operation on the Registry Expert Rule page do?

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

What does the "Open Key" operation on the Registry Expert Rule page do?

Environment

CB Protection Server: All Supported Versions

Resolution

The "Open Key" operation actually tracks "Open with Write Access" registry operations and does not track Reads/Queries of registry keys.

Additional Information

A ticket to update the description of the "Open Key" operation has been submitted.