7MS #588: Becoming a Sysmon Sensei with Amanda Berlin
7 Minute Security · Brian Johnson
September 8, 202324m 40s
Audio is streamed directly from the publisher (traffic.libsyn.com) as published in their RSS feed. Play Podcasts does not host this file. Rights-holders can request removal through the copyright & takedown page.
Show Notes
Today Amanda Berlin from Blumira teaches us how to unlock the power of Sysmon so we can gain insight into the good, bad and ugly things happening on our corporate endpoints! Key takeaways:
- Sysmon turns your windows logging up to 11, and pairs well with a config file like this one or this one.
- Careful if you are are running sysmon on non-SSD drives - the intense number of writes might bring that disk to its knees.
- Just getting started logging all the things with sysmon? Why not pump those logs into a free logging/alerting system like Wazuh?
- I think it was SolarWinds log collector I was trying to think of while recording the show, not CloudTrail.