After some experimenting and after getting more familiar with the way that ESM checks in CCS operate, I managed to create this check. I followed the following steps:
Step 1: Create a template
In ESM Manager, I created a copy of one of the Registry templates that are available and added rows that include the names and values of the expected registry keys (according to what is mentioned in this article).
Step 2: Create and run the ESM Policy
In ESM Manager, I created a policy and added the Registry Module, in which I checked the following values:
- Template File List. (Here I added the template I built)
- Key and value existence
- Allow any priviledged account
- Automatically update snapshots
After creating the policy, run it and wait for it to be finalized.
Step 3: Configure the CCS Check
Create a new check, which will include the following 3 expressions.
1. The first one returns unknown if ESM Message that is returned is error message. This will have the following attributes:
- Category: ESM Message
- Field: Is Error Message
- Operator: =
- Value: False
- Filter: ESM Policy = <name of the policy>,ESM Module Name = '[Registry]'
- Outcome for missing data items = Unknown
2. The second passes if ESM does not return the value "ESM_NOEXISTVALUE" (which means that the key exists). This will have the following attributes,
- Category: ESM Message
- Field: Message String ID
- Operator: !=
- Value: ESM_NOEXISTVALUE
- Filter: ESM Policy = <name of the policy>,ESM Module Name = '[Registry]', Name=<the name of the registry key e.g. HKEY_LOCAL_MACHINE\System\....\keyname>
- Outcome for missing data items = Pass
3 The third passes if ESM does not return the value "ESM_WRONG_DATA" (which means that the key has the correct value). This will have the following attributes,
- Category: ESM Message
- Field: Message String ID
- Operator: !=
- Value: ESM_WRONG_DATA
- Filter: ESM Policy = <name of the policy>,ESM Module Name = '[Registry]', Name=<the name of the registry key e.g. HKEY_LOCAL_MACHINE\System\....\keyname>
- Outcome for missing data items = Pass
This one worked for me. I hope it also works for you.