# microsoft/SysmonForLinux

Sysmon for Linux

Repository: https://github.com/microsoft/SysmonForLinux
Canonical: https://ross.abutalabs.com/products/sysmonforlinux
Language: C
License: MIT
License Family: permissive
Last push: 2026-07-13T23:10:10+00:00

## Health v2 (maintenance only)
Score: 86/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 92, release rhythm 71, longevity 100
- inputs: {"age_days": 2135, "days_push": 51, "days_rel": 118, "gap_med": 44, "n_releases_24m": 8}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2153, forks 221 (observed 2026-08-28T04:06:19.450703+00:00)

## What it is
Sysmon for Linux is a Sysinternals tool that monitors and logs system activity such as process lifetime, network connections, and file system writes. It uses advanced filtering to help identify malicious activity and understand how intruders and malware operate.

## Use cases
- monitor process creation and termination on linux servers
- log network connections made by processes
- detect malware and intruder activity on linux hosts
- audit file system writes across reboots
- feed sysmon events into a SIEM for threat hunting

## When to choose
- you need detailed, configurable system activity telemetry on linux
- you want a windows Sysmon-equivalent for cross-platform detection engineering
- you are building security monitoring or detection rules for linux endpoints

## When to avoid
- you only need lightweight metrics rather than security-focused event logging
- you cannot install kernel-level monitoring components on the host
- you need a GUI-based monitoring solution

## Facets
- artifact type: cli-tool
- maturity: active
- function: monitoring, logging, security
- domain: security, monitoring, operating-systems, developer-tools
- platform: -
- tags: sysinternals, system-monitoring, edr, kernel, event-logging, threat-detection, linux

## Member repositories
- microsoft/SysmonForLinux (main) score 86

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:19.450703+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:50:38.252133+00:00, confidence not recorded.
  - readme: https://github.com/microsoft/SysmonForLinux (fetched 2026-08-28T04:06:19.450703+00:00, sha 6988380b0573)
- Data as of 2026-08-30T08:39:29.467469+00:00.