sysmon-config
by ion-storm
Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events with wide CVE Coverage, and Risk Scoring of CVE, UEBA, Forensic, and MITRE ATT&CK Events.
AI summary
System monitor
A configuration package for advanced system monitoring using Sysmon, designed to detect and alert on various threat activities and provide forensic visibility.
- stars
- 780
- forks
- 143
- watching
- 89
Similar projects
Found by comparing what the projects do, not just their names.
EDR solution
A PowerShell-based EDR system with Sysmon integration to detect and respond to security threats.
System monitoring configuration
A template configuration file for Microsoft Sysinternals' Sysmon to monitor system changes with high-quality event tracing.
System monitor
A remotely-accessible system performance monitoring and task management tool for servers and Raspberry Pi setups
Sysmon config repo
A repository of customizable Sysmon configuration modules for security analysis and threat hunting.
Sysmon toolkit
A curated collection of resources and tools for learning and implementing Microsoft Sysmon for incident detection, threat hunting, and endpoint security monitoring.
lt0/sysmon117
System monitor
A system monitor that provides real-time usage data of Linux systems via a web browser or mobile clients.
Event log analyzer
Utilities for analyzing and visualizing Windows event logs from Sysmon, helping users track and monitor system activity.
System Monitor
A Linux system monitoring tool with task management features similar to Windows Task Manager.
Event log analyzer
Analyzes Sysmon event logs to detect suspicious activity and visualize process and network correlations.
Monitoring template
A comprehensive Sysmon configuration file template with default high-quality event tracing
System Monitor
An application indicator for monitoring system parameters such as CPU temperature, memory usage, network speed and public IP address.
Event processor
A fast and extensible system for processing JSON events from security monitoring tools
Event simulator
A utility to simulate Windows event logs for testing EDR detections and correlation rules
