Sysmon in depth Documentation

JL 141 Reputation points


I was wondering whether there is any actual, throughout and in-depth documentation of Sysmon (ID's and its atributes) and sysmonconfig schema. Often I'm using the "Troubleshooting with the Windows Sysinternal tools" by Mark Russinovich and it is in great detail but very outdated. Can anyone give me some tip (forum, book, online material etc)

Many thanks

Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
1,065 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. dstaulcu 351 Reputation points

    Windows Internals books likely touch on it.

    Otherwise most in depth and readily accessible document I know of can be found here:

    2 people found this answer helpful.
    0 comments No comments