SwiftOnSecurity/sysmon-config resource

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

5630 stars · 1865 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

A heavily commented Microsoft Sysmon configuration file template providing high-quality default event tracing for Windows systems. It serves as both a deployable monitoring baseline and a tutorial for learning Sysmon's filtering capabilities.

Use cases

• set up sysmon event tracing on windows endpoints
• find a starting point sysmon config for threat hunting
• learn how sysmon filtering rules work
• monitor process creation and system changes on windows
• reduce sysmon log noise with tuned exclusions
• deploy endpoint telemetry for incident investigation

When to choose

• you want a well-commented, community-proven Sysmon baseline to deploy quickly
• you are learning Sysmon and want a self-documenting configuration
• you need a lightweight starting point you can fork and customize

When to avoid

• you need an exhaustive, modular rule set - use sysmon-modular instead
• you expect it to cover Windows authentication and native event log auditing - Sysmon complements, not replaces, those
• you want a turnkey solution without environment-specific tuning like antivirus exclusions

Facets

infra-config · maturity maintenance

monitoring logging security security windows monitoring developer-tools windows sysmon sysinternals threat-hunting threat-intelligence endpoint-monitoring configuration-template incident-response

Member repositories

For agents

markdown · JSON · MCP: product_card(name="SwiftOnSecurity/sysmon-config")