Top 23 sysmon open source projects

Windows Event Forwarding subscriptions, configuration files and scripts that assist with implementing ACSC's protect publication, Technical Guidance for Windows Event Logging.

✭ 128

powershell windows logging sysmon

Sysmon Modular

A repository of sysmon configuration modules

✭ 1,229

powershell security-tools modular dfir threat-hunting mitre-attack sysmon

Sysmontools

Utilities for Sysmon

✭ 903

windows monitoring logging threat-hunting threat-intelligence threatintel netsec sysmon

Sentinel Attack

Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK

✭ 676

logging security-tools hcl azure detection cybersecurity threat-hunting mitre-attack siem sysmon

Sysmon Dfir

Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.

✭ 654

sysmon

Sigma

Generic Signature Format for SIEM Systems

✭ 4,418

python Makefile security monitoring elasticsearch logging ids siem sysmon splunk signatures

Sysmonsearch

Investigate suspicious activity by visualizing Sysmon's event log

✭ 302

javascript security elasticsearch kibana sysmon

Sysmon Config

Sysmon configuration file template with default high-quality event tracing

✭ 3,287

windows monitoring logging threat-hunting threatintel netsec sysmon sysinternals

ir scripts

incident response scripts

✭ 17

powershell windows incident-response forensics dfir sysmon threat-hunting

sysmon-splunk-app

Sysmon Splunk App

✭ 42

splunk sysmon

system-monitor

Qt based replacement for gnome system monitor

✭ 16

C++QMake linux qt monitor sysmon

SysmonConfigPusher

Pushes Sysmon Configs

✭ 59

C#windows sysmon threat-hunting siem

SysmonResources

Consolidation of various resources related to Microsoft Sysmon & sample data/log

✭ 64

python threat sysmon threat-hunting

SWELF

Simple Windows Event Log Forwarder (SWELF). Its easy to use/simply works Log Forwarder and EVTX Parser. Almost in full release here at https://github.com/ceramicskate0/SWELF/releases/latest.

✭ 23

C#windows analytics analysis dotnet detection logging logs cybersecurity sysmon siem hunting forwarder defense eventlog log-forwarder evtx logging-framework logging-agent windowsevents

Zircolite

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

✭ 443

python detection sysmon auditd sigma evtx sigma-rules

TA-Sysmon-deploy

Deploy and maintain Symon through the Splunk Deployment Sever

✭ 31

Batchfile splunk dfir sysmon threat-hunting splunk-deployment

1-23 of 23 sysmon projects