olafhartong/sysmon-modular resource

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

3119 stars · 657 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

A modular repository of Microsoft Sysmon configuration modules maintained in PowerShell, with scripts to generate custom sysmonconfig.xml files. It provides pre-generated default, default+, and verbose configurations mapped to MITRE ATT&CK for threat hunting and DFIR.

Use cases

• generate a custom sysmon configuration for my windows environment
• find a good starting sysmon config for threat hunting
• tune sysmon event logging with modular include/exclude rules
• map sysmon events to MITRE ATT&CK techniques
• build a verbose sysmon config for DFIR investigations

When to choose

• you run Sysmon on Windows and want a maintained, modular, MITRE-mapped configuration baseline
• you need to generate tailored Sysmon configs by merging your own modules
• you do threat hunting or DFIR and want richer event coverage

When to avoid

• you need an EDR or detection engine rather than a Sysmon config
• you want a drop-in production config without per-environment tuning
• you are not using Windows or Sysmon

Facets

dataset · maturity active

security monitoring configuration-management developer-tools security windows developer-tools windows sysmon dfir threat-hunting mitre-attack sysmon-config modular-config powershell security-tools event-logging

Member repositories

For agents

markdown · JSON · MCP: product_card(name="olafhartong/sysmon-modular")