Fix Registry Collector not being enabled when match-run-id is enabl…

…ed against a previous run with Registry Collector enabled. (#734)
microsoft · Feb 13, 2025 · e25033d · e25033d
1 parent ebe5c4b
commit e25033d
Showing 1 changed file with 17 additions and 12 deletions.
diff --git a/Cli/AttackSurfaceAnalyzerClient.cs b/Cli/AttackSurfaceAnalyzerClient.cs
@@ -1488,38 +1488,43 @@ public static ASA_ERROR RunCollectCommand(CollectCommandOptions opts)
                                 opts.EnableNetworkPortCollector = true;
                                 break;
 
+                            case RESULT_TYPE.REGISTRY:
+                                opts.EnableRegistryCollector = true;
+                                break;
+
                             case RESULT_TYPE.CERTIFICATE:
                                 opts.EnableCertificateCollector = true;
                                 break;
 
-                            case RESULT_TYPE.COM:
-                                opts.EnableComObjectCollector = true;
+                            case RESULT_TYPE.SERVICE:
+                                opts.EnableServiceCollector = true;
+                                break;
+
+                            // Groups are a separate result type but are collected with the user collector
+                            case RESULT_TYPE.USER:
+                                opts.EnableUserCollector = true;
                                 break;
 
                             case RESULT_TYPE.FIREWALL:
                                 opts.EnableFirewallCollector = true;
                                 break;
 
-                            case RESULT_TYPE.LOG:
-                                opts.EnableEventLogCollector = true;
+                            case RESULT_TYPE.COM:
+                                opts.EnableComObjectCollector = true;
                                 break;
 
-                            case RESULT_TYPE.SERVICE:
-                                opts.EnableServiceCollector = true;
+                            case RESULT_TYPE.LOG:
+                                opts.EnableEventLogCollector = true;
                                 break;
 
-                            case RESULT_TYPE.USER:
-                                opts.EnableUserCollector = true;
+                            case RESULT_TYPE.TPM:
+                                opts.EnableTpmCollector = true;
                                 break;
 
                             case RESULT_TYPE.KEY:
                                 opts.EnableKeyCollector = true;
                                 break;
 
-                            case RESULT_TYPE.TPM:
-                                opts.EnableTpmCollector = true;
-                                break;
-
                             case RESULT_TYPE.PROCESS:
                                 opts.EnableProcessCollector = true;
                                 break;