Ingesting Sysmon Event Logs

Sysmon can be a valuable addition to any defender's toolkit, given it's verbosity and generous log data. It's worth noting that LimaCharlie's native EDR capabilities mirror much of the same telemetry. However, Sysmon and LimaCharlie can be combined to provide granular coverage across Windows systems.

With Sysmon deployed, you can utilize LimaCharlie's native Windows Event Log (WEL) streaming capabilities to bring logs into the Sensor timeline.

1. Install Sysmon on the endpoint. This can easily be done via LimaCharlie's Payload functionality.

2. Within the organization where you wish to collect Sysmon data, go to the Event Collection > Event Collection Rules section.

3. Ensure that for Windows systems, WEL events are collected.

4. Go to the Artifact Collection section and add a new collection rule with the following path to bring in all Sysmon events:

wel://Microsoft-Windows-Sysmon/Operational:*

Note: You can use tagging or other filters to narrow down the systems that logs are collected from.

5. Allow up to 10 minutes for data to come into LimaCharlie after setting up a new Artifact Collection rule. Data will flow in real-time after that point.

6. Navigate to the Timeline view of a Sensor to confirm that Sysmon logs are present. You can search for Event Type WEL and Search for Microsoft-Windows-Sysmon to validate the telemetry.