From babd9df0d673c9b114eefe08cf7898510ee7f684 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 17 Jun 2025 17:09:39 -0700
Subject: [PATCH] Update print_processor_registry_autostart.yml

risk message used a field where the datamodel prefix was still included. This meant that it failed the risk message substitution
---
 detections/endpoint/print_processor_registry_autostart.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/print_processor_registry_autostart.yml b/detections/endpoint/print_processor_registry_autostart.yml
index bc2838bf91..6e1b378c86 100644
--- a/detections/endpoint/print_processor_registry_autostart.yml
+++ b/detections/endpoint/print_processor_registry_autostart.yml
@@ -48,7 +48,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: modified/added/deleted registry entry $Registry.registry_path$ on $dest$
+  message: modified/added/deleted registry entry $registry_path$ on $dest$
   risk_objects:
   - field: dest
     type: system