Deploy a baseline Sysmon configuration across Windows machines to start logging process launches, network connections, and file changes for threat detection.
Use the heavily commented XML as a learning guide to understand which Windows events matter for security monitoring and why each rule is included.
Fork the configuration and tune out antivirus and trusted software noise to reduce event volume before feeding logs into a SIEM.
Use as a starting point before adopting sysmon-modular for teams that need more exhaustive Windows event coverage.
Must run Sysmon as administrator, requires environment-specific tuning to filter antivirus and trusted software noise before production rollout.
Sysmon is a free Windows tool from Microsoft that records detailed information about what programs are doing on your computer: things like new processes starting, network connections being made, and files being changed. By itself, Sysmon is just an engine. To tell it what to watch and what to ignore, you give it a configuration file in XML format. This repository provides one such configuration file, designed as a ready-to-use starting point that any Windows security team can fork and adapt. The configuration captures meaningful activity while keeping performance impact low. It focuses on system-level changes rather than authentication events, which Windows tracks separately through its own logging system. The XML file is heavily commented, with explanations throughout each section. This makes it useful both as a working configuration and as a guide for understanding what kinds of activity matter when looking for threats. You install it by running Sysmon as an administrator and pointing it at the file. After that, Sysmon writes events to the Windows Event Log, where your security tools or log management system can pick them up. Before rolling this out across a fleet of computers, you will need to test it in your own environment and tune it. Your antivirus software, for example, will likely generate a large volume of events that are not useful for threat detection, and you will want to filter those out. The configuration is structured to make that kind of adjustment straightforward. The project also expects software to be installed system-wide rather than in user directories, since user directories get extra monitoring. The project is meant to be forked and customized. The README points to a companion project called sysmon-modular for teams that want a more exhaustive approach, but this configuration covers the most practical monitoring starting points in a single file.
← swiftonsecurity on gitmyhub — every repo by this author, as a profile.
Verify against the repo before relying on details.