sysmon-config

Sysmon is a free Windows tool from Microsoft that records detailed information about what programs are doing on your computer: things like new processes starting, network connections being made, and files being changed. By itself, Sysmon is just an engine. To tell it what to watch and what to ignore, you give it a configuration file in XML format.

This repository provides one such configuration file, designed as a ready-to-use starting point that any Windows security team can fork and adapt. The configuration captures meaningful activity while keeping performance impact low. It focuses on system-level changes rather than authentication events, which Windows tracks separately through its own logging system.

The XML file is heavily commented, with explanations throughout each section. This makes it useful both as a working configuration and as a guide for understanding what kinds of activity matter when looking for threats. You install it by running Sysmon as an administrator and pointing it at the file. After that, Sysmon writes events to the Windows Event Log, where your security tools or log management system can pick them up.

Before rolling this out across a fleet of computers, you will need to test it in your own environment and tune it. Your antivirus software, for example, will likely generate a large volume of events that are not useful for threat detection, and you will want to filter those out. The configuration is structured to make that kind of adjustment straightforward. The project also expects software to be installed system-wide rather than in user directories, since user directories get extra monitoring.

The project is meant to be forked and customized. The README points to a companion project called sysmon-modular for teams that want a more exhaustive approach, but this configuration covers the most practical monitoring starting points in a single file.