#Sysmon
Showing 12 of 12 repositories tagged #sysmon, ranked by stars
Main Sigma Rule Repository
Block spying and tracking on Windows
Automate the creation of a lab environment complete with security tooling and logging best practices
Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
Documentation and scripts to properly enable Windows event logs.
Investigate suspicious activity by visualizing Sysmon's event log
The world's most powerful System Activity Monitor Engine · 一款功能强大的终端行为采集防御开发套件 ~ 旨在帮助EDR、零信任、数据安全、审计管控等终端安全软件可以快速实现产品功能， 而不用关心底层驱动的开发、维护和兼容性问题，让其可以专注于业务开发
Endpoint detection & Malware analysis software
Sysmon and wazuh integration with Sigma sysmon rules [updated]
This script enhances endpoint logging telemetry for the purpose of advanced malware threat detection or for building detections or malware analysis. This can be used in production, however you might want to tune the GPO edits as needed.
Ansible role for installing Sysmon with popular config files included.