# trustedsec/SysmonCommunityGuide

TrustedSec Sysinternals Sysmon Community Guide

Repository: https://github.com/trustedsec/SysmonCommunityGuide
Canonical: https://ross.abutalabs.com/products/sysmoncommunityguide
Language: Python
License Family: other
Last push: 2026-06-30T10:13:45+00:00

## Health v2 (maintenance only)
Score: 71/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 90, release rhythm 29, longevity 100
- inputs: {"age_days": 2415, "days_push": 64, "days_rel": 261, "gap_med": null, "n_releases_24m": 1}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1431, forks 185 (observed 2026-08-28T04:04:42.999839+00:00)

## What it is
A community-maintained guide by TrustedSec covering Microsoft Sysinternals Sysmon on Windows and Linux, including installation, configuration, event types, and detection engineering fundamentals. It is licensed under Creative Commons BY-SA and serves as reference documentation rather than a software tool.

## Use cases
- learn how to install and configure Sysmon on Windows
- understand Sysmon event types like process creation and registry actions
- set up Sysmon on Linux with eBPF
- write better Sysmon configuration files for threat detection
- learn detection engineering fundamentals with Sysmon telemetry
- find documentation on Sysmon network and DNS events

## When to choose
- you are a security engineer or threat hunter deploying or tuning Sysmon
- you need a free, community-driven reference for Sysmon event IDs and configuration
- you want to learn detection engineering using endpoint telemetry

## When to avoid
- you need a runnable tool or script rather than documentation
- you need vendor-official Microsoft documentation or support
- you need a general-purpose EDR or SIEM product

## Facets
- artifact type: learning-resource
- maturity: active
- function: security, monitoring, documentation
- domain: security, windows, developer-tools
- platform: windows, cross-platform
- tags: sysmon, sysinternals, detection-engineering, threat-hunting, community-guide, endpoint-monitoring, siem, linux

## Member repositories
- trustedsec/SysmonCommunityGuide (main) score 71

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:42.999839+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:37:09.271935+00:00, confidence not recorded.
  - readme: https://github.com/trustedsec/SysmonCommunityGuide (fetched 2026-08-28T04:04:42.999839+00:00, sha 44101ebbbeb5)
- Data as of 2026-08-30T08:39:29.467469+00:00.