Operation = "RegSetValue" => include Operation = "RegDeleteValue" Operation = "RegCreateKey" Operation = "RegRenameKey" Operation = "RegSetInfoKey" Shows only registry-update operations.