nshalabi/SysmonTools

Health v2 · maintenance only

Adoption not part of the score

1659 stars · 209 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Sysmon Tools is a collection of utilities for analyzing, visualizing, and managing Microsoft Sysmon logs, centered on Sysmon View, an open-source Electron desktop app. It correlates Sysmon events into interactive process session diagrams, event views, and GeoIP maps for security analysts and threat hunters.

Use cases

• visualize sysmon logs as interactive process session diagrams
• correlate sysmon events by process guid and session
• investigate suspicious command lines and network connections from sysmon data
• filter and pin events of interest during threat hunting
• map external ip addresses from sysmon logs with geoip
• look up hashes and ips on virustotal during incident response
• group and explore large sysmon event datasets by machine or event type

When to choose

• you are a DFIR analyst or threat hunter working with Microsoft Sysmon logs on Windows
• you need a free, open-source GUI to explore and visualize sysmon event data
• you want quick VirusTotal and GeoIP enrichment of sysmon indicators

When to avoid

• you need automated, headless sysmon log collection or alerting pipelines
• your primary platform is Linux or macOS and you cannot run a Windows-first desktop app
• you need a SIEM-scale solution for centralized enterprise log management

Facets

application · maturity active

logging monitoring data-visualization security security developer-tools windows windows cross-platform sysmon dfir threat-hunting threat-intelligence log-analysis electron security-analytics desktop

Member repositories

For agents

markdown · JSON · MCP: product_card(name="nshalabi/SysmonTools")