Security Cadence: Sysmon (Logging Part 2 out of ?????)

• sysmon-config

  35 4,609 0.0

  Sysmon configuration file template with default high-quality event tracing

There are also some excellent sample configuration files out there, and -in my opinion- the best of them is from Swift on Security: https://github.com/SwiftOnSecurity/sysmon-config

• sysmon-modular

  15 2,515 4.8 PowerShell

  A repository of sysmon configuration modules

Another really excellent resource (also called out by Swift) is Olaf Hartong’s Sysmon-Modular project: https://github.com/olafhartong/sysmon-modular As well as having a few full configs, Olaf’s project has modular XML configurations for each supported Sysmon Event ID. This can be incredibly helpful for fine tuning your configs.

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• SysmonForLinux

  11 1,634 6.7 C
  

Did you know that Sysmon is so fantastic that Microsoft ported it to Linux? They sure did and it is awesome. It can be found here: https://github.com/Sysinternals/SysmonForLinux

• SysmonTools

  2 1,451 3.3

  Utilities for Sysmon

Suggest a related project