7MS #588: Becoming a Sysmon Sensei with Amanda Berlin

7MS #588: Becoming a Sysmon Sensei with Amanda Berlin

Today Amanda Berlin from Blumira teaches us how to unlock the power of Sysmon so we can gain insight into the good, bad and ugly things happening on our corporate endpoints! Key takeaways:

  • Sysmon turns your windows logging up to 11, and pairs well with a config file like this one or this one.
  • Careful if you are are running sysmon on non-SSD drives - the intense number of writes might bring that disk to its knees.
  • Just getting started logging all the things with sysmon? Why not pump those logs into a free logging/alerting system like Wazuh?
  • I think it was SolarWinds log collector I was trying to think of while recording the show, not CloudTrail.

Avsnitt(684)

Populärt inom Politik & nyheter

p3-krim
svd-dokumentara-berattelser-2
rss-krimstad
flashback-forever
olyckan-inifran
rss-viva-fotboll
aftonbladet-daily
rss-vad-fan-hande
svenska-fall
rss-sanning-konsekvens
krimmagasinet
rss-expressen-dok
motiv
fordomspodden
svd-nyhetsartiklar
dagens-eko
rss-frandfors-horna
blenda-2
spar
spotlight