RegProbeBasic Deprecated

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

keys = [r"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
        r"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run",
        r"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components",
        r"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components",
        r"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
        r"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce"]


def Reg2Markdown(baseKey, regResp):
    res, mdRows = [], ''
    if isError(regResp[0]):
        res += regResp
    elif len(regResp) > 1:
        contents = 'Unexpected output from D2RegQuery - more than one entry returned:\n' + '\n'.join([str(x) for x in regResp])
        res.append({'Type': entryTypes['error'], 'ContentsFormat': formats['text'],
                   'Contents': contents})
    else:
        subkeys = regResp[0]['Contents']
        for sk in subkeys:
            if type(subkeys[sk]) == dict:
                for ssk in subkeys[sk]:
                    mdRows += '\n|' + str(baseKey) + '\\' + str(sk) + '|' + str(ssk) + '|' + str(subkeys[sk][ssk]) + '|'
            else:
                mdRows += '\n|' + str(baseKey) + '|' + str(sk) + '|' + str(subkeys[sk]) + '|'
    return (res, mdRows)


res = []
if 'system' in demisto.args():
    system = demisto.args()['system']
elif 'using' in demisto.args():
    system = demisto.args()['using']
else:
    demisto.results({'Type': entryTypes['error'], 'ContentsFormat': formats['text'],
                    'Contents': 'You must provide "system" or "using" as arguments.'})
    sys.exit(0)
mdTable = '### Results for short registry probe of system *' + system + '*'
mdTable += '\n|Key|SubKey|Value|'
mdTable += '\n|-----|------|-----|'
for k in keys:
    regPath = NormalizeRegistryPath(k)
    cmdResp = demisto.executeCommand('D2RegQuery', {'using': system, 'regpath': regPath})
    moreEntries, moreRows = Reg2Markdown(regPath, cmdResp)
    mdTable += moreRows
    res += moreEntries
res.append({'Type': entryTypes['note'], 'ContentsFormat': formats['markdown'], 'Contents': mdTable})
demisto.results(res)