Microsoft Sysmon is a Windows system service and device driver that provides detailed logging of system activity, including process creation, network connections, file modifications, and registry changes.
This integration enriches and ingests the Sysmon event logs. Use the pre-built dashboard to get a high-level view of the Sysmon events helping security teams monitor system activity.
Setup
Installation
To install the Microsoft Sysmon integration, run the following Agent installation command and the steps below. For more information, see the Integration Management documentation.
Note: This step is not necessary for Agent version >= 7.66.0.
Run powershell.exe as admin and execute the following command:
Download the zip file from the Sysmon download page. Extract its zip file content.
Create an XML file for configuring Sysmon. For example, if you want to monitor processes created by apps from AppData folders, the configuration file will look like content shown below. You can add more event filters under the EventFiltering XML tag for other events in the same way.
Note: Sysmon is highly configurable using the XML configuration file, which allows you to:
Control which events to monitor
Filter events based on processes, paths, etc.
Enabling too many Sysmon event types can lead to excessive data ingestion. Community resources such as sysmon-modular and the SwiftOnSecurity Sysmon config provide recommended configurations, including examples of event inclusions and exclusions. These are intended as a starting point, and you can refer to them when tuning your own configuration.
Run the following command as admin from the extracted folder:
.\Sysmon-i[<configfile>]
For more details, please refer to the Sysmon docs.