|
| 1 | +# Agent Integration: Microsoft Sysmon |
| 2 | + |
| 3 | +## Overview |
| 4 | + |
| 5 | +[Microsoft Sysmon][4] is a Windows system service and device driver that provides detailed logging of system activity, including process creation, network connections, file modifications, and registry changes. |
| 6 | + |
| 7 | +This integration enriches and ingests the [Sysmon event logs][5]. Use the pre-built dashboard to get a high-level view of the Sysmon events helping security teams monitor system activity. |
| 8 | + |
| 9 | +## Setup |
| 10 | + |
| 11 | +### Installation |
| 12 | + |
| 13 | +To install the Microsoft Sysmon integration, run the following Agent installation command and the steps below. For more information, see the [Integration Management][6] documentation. |
| 14 | + |
| 15 | +**Note**: This step is not necessary for Agent version >= 7.66.0. |
| 16 | + |
| 17 | +Run powershell.exe as admin and execute the following command: |
| 18 | + ```powershell |
| 19 | + & "$env:ProgramFiles\Datadog\Datadog Agent\bin\agent.exe" integration install datadog-microsoft_sysmon==1.0.0 |
| 20 | + ``` |
| 21 | + |
| 22 | +### Configuration |
| 23 | + |
| 24 | +#### Configure Log Collection |
| 25 | + |
| 26 | +1. Collecting logs is disabled by default in the Datadog Agent. Enable it in the `datadog.yaml` file with: |
| 27 | + |
| 28 | + ```yaml |
| 29 | + logs_enabled: true |
| 30 | + ``` |
| 31 | +
|
| 32 | +2. Add this configuration block to your `microsoft_sysmon.d/conf.yaml` file to start collecting your Microsoft Sysmon logs: |
| 33 | + |
| 34 | + ```yaml |
| 35 | + logs: |
| 36 | + - type: windows_event |
| 37 | + channel_path: "Microsoft-Windows-Sysmon/Operational" |
| 38 | + source: microsoft-sysmon |
| 39 | + service: microsoft-sysmon |
| 40 | + sourcecategory: windowsevent |
| 41 | + ``` |
| 42 | + |
| 43 | +3. [Restart the Agent][3]. |
| 44 | + |
| 45 | +#### Configure Sysmon |
| 46 | + |
| 47 | +Follow these steps to install Sysmon: |
| 48 | +1. Download the zip file from the [Sysmon download page][4]. Extract its zip file content. |
| 49 | +2. Create an XML file for configuring Sysmon. For example, if you want to monitor processes created by apps from AppData folders, the configuration file will look like content shown below. You can add more event filters under the `EventFiltering` XML tag for other events in the same way. |
| 50 | + |
| 51 | + ```xml |
| 52 | + <Sysmon schemaversion="4.90"> |
| 53 | + <EventFiltering> |
| 54 | + <ProcessCreate onmatch="include"> |
| 55 | + <Image condition="contains">C:\Users\*\AppData\Local\Temp\</Image> |
| 56 | + <Image condition="contains">C:\Users\*\AppData\Roaming\</Image> |
| 57 | + </ProcessCreate> |
| 58 | + </EventFiltering> |
| 59 | + </Sysmon> |
| 60 | + ``` |
| 61 | + |
| 62 | +3. Execute the command as admin from the extracted folder: |
| 63 | + |
| 64 | + ```powershell |
| 65 | + .\Sysmon -i [<configfile>] |
| 66 | + ``` |
| 67 | + |
| 68 | +**Note:** Sysmon is highly configurable using the configuration (XML) file which allows you to: |
| 69 | +- Control which events to monitor |
| 70 | +- Filter events based on processes, paths, etc. |
| 71 | + |
| 72 | +Enabling too many event types can result in excessive data ingestion. Only critical security events should be enabled based on the threat model and monitoring needs. |
| 73 | +These events should be selectively enabled for critical system directories, processes, and users to avoid unnecessary log noise. |
| 74 | + |
| 75 | +For more details on configuration, please refer to the [Sysmon docs][7]. |
| 76 | + |
| 77 | +### Validation |
| 78 | + |
| 79 | +[Run the Agent's status subcommand][8] and look for `microsoft_sysmon` under the Checks section. |
| 80 | + |
| 81 | +## Data Collected |
| 82 | + |
| 83 | +### Logs |
| 84 | + |
| 85 | +The Microsoft Sysmon integration collects the following [Sysmon event logs][5]: |
| 86 | +- Process activity logs |
| 87 | +- Network activity logs |
| 88 | +- File activity logs |
| 89 | +- Registry activity logs |
| 90 | +- WMI activity logs |
| 91 | +- Sysmon service activity logs |
| 92 | +- Named Pipe and Clipboard activity logs |
| 93 | + |
| 94 | +### Metrics |
| 95 | + |
| 96 | +The Microsoft Sysmon integration does not include any metrics. |
| 97 | + |
| 98 | +### Events |
| 99 | + |
| 100 | +The Microsoft Sysmon integration does not include any events. |
| 101 | + |
| 102 | +### Service Checks |
| 103 | + |
| 104 | +The Microsoft Sysmon integration does not include any service checks. |
| 105 | + |
| 106 | +## Support |
| 107 | + |
| 108 | +Need help? Contact [Datadog support][1]. |
| 109 | + |
| 110 | +[1]: https://docs.datadoghq.com/help/ |
| 111 | +[2]: https://app.datadoghq.com/account/settings/agent/latest |
| 112 | +[3]: https://docs.datadoghq.com/agent/configuration/agent-commands/#restart-the-agent |
| 113 | +[4]: https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon |
| 114 | +[5]: https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#events |
| 115 | +[6]: https://docs.datadoghq.com/agent/guide/integration-management/?tab=windowspowershell#install |
| 116 | +[7]: https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#configuration-files |
| 117 | +[8]: https://docs.datadoghq.com/agent/guide/agent-commands/#agent-status-and-information |
0 commit comments