sysmon-config

Sysmon configuration file template with default high-quality event tracing

2Distinct people

2Mentions

0Explicit recommenders

5.7KGitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

Sysmon configuration file template with default high-quality event tracing

GitHub

No documented product use has been verified yet.

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

No other repository is repeatedly linked in the same discussions.

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

HN mentions by year2 dated mentions

Observed mentions: 2017-12-06 12:38:43 UTC to 2021-10-15 12:06:31 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Comments
2017	2017-01-01 00:00:00 UTC	2018-01-01 00:00:00 UTC	1	1
2018	2018-01-01 00:00:00 UTC	2019-01-01 00:00:00 UTC	0	0
2019	2019-01-01 00:00:00 UTC	2020-01-01 00:00:00 UTC	0	0
2020	2020-01-01 00:00:00 UTC	2021-01-01 00:00:00 UTC	0	0
2021	2021-01-01 00:00:00 UTC	2022-01-01 00:00:00 UTC	1	1

2 sources

Sysmon [1] is a popular monitoring tool on Windows. It is based on ETW and its custom driver and provides great details on what is happening in the system. To make the logs relevant, we need to configure it (SwiftOnSecurity created a good base config file [2]). Yesterday, MS released the first version of Sysmon for Linux and made it open-source (MIT license)[3]. It is based on eBPF. In [4] they show how they use it in Azure to collect events from the Linux VMs. - [1] https://docs.microsoft.com/en-us/sysinternals/downloads/sysm... - [2] https://github.com/SwiftOnSecurity/sysmon-config - [3] https://github.com/Sysinternals/SysmonForLinux - [4] https://techcommunity.microsoft.com/t5/azure-sentinel/automa...

SysMon is the next step after changing the default audit policy. https://github.com/MHaggis/sysmon-dfir As of September 2017, v6.1 supports monitoring WMI subscribers. https://rawsec.lu/blog/posts/2017/Sep/19/sysmon-v610-vs-wmi-... Unfortunately I can no longer point to a canonical "best practices" configuration as the original has been neglected; however it may serve as a starting point: https://github.com/SwiftOnSecurity/sysmon-config