Sysmon Config File Version Control RRS feed

  • Question

  • Is it possible to add an Admin Controlled Sysmon Config version number to the Sysmon Config file XML Schema? Something that would appear in the Registry or when sysmon -c is run.

    In a large organization there are frequent changes to the Sysmon Config Version. To check for saturation and compliance of the newest configuration organizations need a way to query the current config that is loaded.

    None of the notes seem to be added to the registry or are returned by the sysmon -c command.

    Monday, June 15, 2020 7:09 PM

All replies

  • Hi Michael

    this is a great suggestion. I have added it to the Sysmon backlog and flagged it for consideration at the next backlog review in early July


    Friday, June 19, 2020 8:06 AM