2 ms·
Sysmon for Linux 1.0.0 Released
- lowleveldesign 5y agoSysmon [1] is a popular monitoring tool on Windows. It is based on ETW and its custom driver and provides great details on what is happening in the system. To make the logs relevant, we need to configure it (SwiftOnSecurity created a good base config file [2]). Yesterday, MS released the first version of Sysmon for Linux and made it open-source (MIT license)[3]. It is based on eBPF. In [4] they show how they use it in Azure to collect events from the Linux VMs. - [1] https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon https://docs.microsoft.com/en-us/sysinternals/downloads/sysm... - [2] https://github.com/SwiftOnSecurity/sysmon-config https://github.com/SwiftOnSecurity/sysmon-config - [3] https://github.com/Sysinternals/SysmonForLinux https://github.com/Sysinternals/SysmonForLinux - [4] https://techcommunity.microsoft.com/t5/azure-sentinel/automating-the-deployment-of-sysmon-for-linux-and-azure-sentinel/ba-p/2847054 https://techcommunity.microsoft.com/t5/azure-sentinel/automa...