Hi if I install sysmon without config file what happen for logs that it save?

Installing sysmon without a config file just uses MSFT's defaults which only records essential system activities like process (creation/termination), mods to the registry and a few other things but it won't capture network events by default. You've got to create/tweek a config file to get it to recoord what you need/want to monitor. Logs will be stored here: Applications and Services Logs/Microsoft/Windows/Sysmon/Operational

What happen install sysmon without config file

Accepted answer

Will 420 Reputation points

2023-07-29T10:17:11.29+00:00

Installing sysmon without a config file just uses MSFT's defaults which only records essential system activities like process (creation/termination), mods to the registry and a few other things but it won't capture network events by default.

You've got to create/tweek a config file to get it to recoord what you need/want to monitor.

Logs will be stored here:

Applications and Services Logs/Microsoft/Windows/Sysmon/Operational
Please sign in to rate this answer.

1 person found this answer helpful.
Will 420 Reputation points

2023-07-29T20:53:07.0333333+00:00

Also forgot to mention - you can go to SwiftonSecurity and get their config file which is a really good which can tweek based on your own requirements.

Then you can figure out how to ingest the log into a SIEM if you have one like Splunk, Sentinel.

However, alot of EDR's now serve the function of sysmon so you may not need a sysmon - it just depends on what your environment has, is currently at or can afford.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

What happen install sysmon without config file

0 additional answers

Your answer