args:
- description: This entry ID for the reg file.
  name: entryID
  required: true
- auto: PREDEFINED
  defaultValue: All
  description: This argument allows the user to specify which of the following objects in the registry to parse. Default is "All".
  name: registryData
  predefined:
  - All
  - None
  - Users
  - MachineStartup
  - UserStartup
  - MachineRunOnce
  - UserRunOnce
  - Services
  - DelayedServices
  - UserRecentApps
  - Timezone
  - Networks
  - USB
  - LastLoggedOnUser
- description: A comma-separated list of registry paths to parse. Try to keep your searches as exact as possible, for example registry_path=`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList`.
  name: customRegistryPaths
- description: defines the maximum number of records to return as table to the war-room.
  name: hrMaxResults
  defaultValue: "50"
comment: "This command uses the Registry Parse automation to extract critical forensics data from a registry file. The essential values are specified by the argument. \n"
commonfields:
  id: RegistryParse
  version: -1
dockerimage: demisto/python3:3.12.13.10116658
enabled: true
name: RegistryParse
outputs:
- contextPath: RegistryForensicDataRaw.Type
  description: The registry data type. "Custom" for custom registry path.
- contextPath: RegistryForensicDataRaw.RegistryPath
  description: The registry key path.
- contextPath: RegistryForensicDataRaw.RegistryKey
  description: The registry key.
- contextPath: RegistryForensicDataRaw.RegistryValue
  description: The registry value.
- contextPath: RegistryForensicData.Users.Sid
  description: User SID.
- contextPath: RegistryForensicData.Users.Guid
  description: User GUID.
- contextPath: RegistryForensicData.LastLoggedOnUser
  description: Last user to be logged in.
- contextPath: RegistryForensicData.TimeZone
  description: Registry ime zone.
- contextPath: RegistryForensicData.Services.DisplayName
  description: Registry service name.
runas: DBotWeakRole
script: ''
scripttarget: 0
subtype: python3
tags: []
type: python
fromversion: 6.0.0
tests:
- No tests (auto formatted)