Security Cadence: Sysmon (Logging Part 2 out of ?????)

• sysmon-config

  34 4,565 0.0

  Sysmon configuration file template with default high-quality event tracing

There are also some excellent sample configuration files out there, and -in my opinion- the best of them is from Swift on Security: https://github.com/SwiftOnSecurity/sysmon-config

• sysmon-modular

  15 2,485 6.8 PowerShell

  A repository of sysmon configuration modules

Another really excellent resource (also called out by Swift) is Olaf Hartong’s Sysmon-Modular project: https://github.com/olafhartong/sysmon-modular As well as having a few full configs, Olaf’s project has modular XML configurations for each supported Sysmon Event ID. This can be incredibly helpful for fine tuning your configs.

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• SysmonForLinux

  11 1,605 6.8 C
  

Did you know that Sysmon is so fantastic that Microsoft ported it to Linux? They sure did and it is awesome. It can be found here: https://github.com/Sysinternals/SysmonForLinux

• SysmonTools

  2 1,445 3.5

  Utilities for Sysmon

Suggest a related project