Skip to content
Investigate suspicious activity by visualizing Sysmon's event log
Branch: master
Clone or download
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
docker initial commit Sep 5, 2018
images Updated image Sep 6, 2018
script initial commit Sep 5, 2018
stixioc-import-server initial commit Sep 5, 2018
sysmon_search_plugin
LICENSE.txt initial commit Sep 5, 2018
README.md initial commit Sep 5, 2018

README.md

SysmonSearch

SysmonSearch make event log analysis more effective and less time consuming, by aggregating event logs generated by Microsoft's Sysmon.

SysmonSearch system

System Overview

SysmonSearch uses Elasticserach and Kibana (and Kibana plugin).

  • Elasticserach
    Elasticsearch collects/stores Sysmon's event log.
  • Kibana
    Kibana provides user interface for your Sysmon's event log analysis. The following functions are implemented as Kibana plugin.
    • Visualizes Function
      This function visualizes Sysmon's event logs to illustrate correlation of processes and networks.
    • Statistical Function
      This function collects the statistics of each device or Sysmon's event ID.
    • Monitor Function
      This function monitor incoming logs based on the preconfigured rules, and trigers alert.
  • StixIoC server
    You can add search/monitor condition by uploading STIX/IOC file. From StixIoC server Web UI, you can upload STIXv1, STIXv2 and OpenIOC format files.

Use SysmonSearch

To try SysmonSearch, you can either 1)install softwares to your own linux enviroment with following instractions or 2)use docker image:

  1. Install to your own linux box
  2. Use docker image

Documentation

For details, please check the SysmonSearch wiki.

You can’t perform that action at this time.