Sysmon config¶

reference

SwiftOnSecurity's battle-tested Sysmon logging configuration, ready to deploy.

Sysmon config screenshot

Location¶

/opt/detectops/threat-hunting/sysmon-config

Windows-only

copy sysmonconfig-export.xml and run sysmon64 -i sysmonconfig-export.xml

Part of the Threat Hunting & Endpoint Analysis toolset in DetectOps.