RegistryPatternSpec

RegistryPatternSpec describes one Windows registry key search pattern and optional value-level predicates. Assigned a stable pattern_id UUID by orion-hunt-service at hunt creation time (see design decision D6).

Fields

Field	Type	Description
hiveRoot	RegistryHiveRoot!	Structured registry root. When set, keyPath holds the root-relative path and keyPattern is a derived mirror. Takes precedence over keyPattern.
keyPath	String!	Root-relative key path; required when hiveRoot is set.
keyPattern	String!	Output-only: denormalized mirror of hive_root + key_path, populated by OHS on create/update for downstream consumers that read this field. Not accepted as an input; set hive_root and key_path instead.
patternId	String!	Stable UUID assigned by orion-hunt-service at hunt creation. Must be non-empty; used as the join key between match rows and their predicate context in the hunt config.
valueDataContains	String!	Case-insensitive substring match against value data.
valueDataEq	String!	Case-insensitive exact equality match against value data.
valueDataNotContains	String!	Substring must be absent from value data (case-insensitive).
valueDataNotEq	String!	Value data must not equal this string (case-insensitive).
valueNames	[String!]!	Exact value name match. Callers set exactly one entry; kept as repeated to pass the value name alongside the other predicates for a single key in the same block.
valueTypeList	[RegistryValueType!]!	Structured value-type filter; may hold multiple value types (OR semantics), unlike valueNames above. Takes precedence over valueTypes when non-empty.
valueTypes	[String!]!	Deprecated: use valueTypeList for new hunts. Kept as a denormalized mirror when valueTypeList is populated.

Used By

Referenced by

• ThreatHuntBaseConfig.registryPatterns
• ThreatHuntConfig.registryPatterns