Sysmon-modular to unify two XML configurations

[skynet-shd]

Hi all,

I've been thinking about an idea of sysmon modular. But what I want to do , it's similar what you've done.

My idea, it's the following: I've got two sysmon XML configuration file, one of them it's a sysmon configuration "Base" (I mean, like a template with common events) and another configuration file with particular events. What I would like to do, it's to find a way to mergue the particular configuration file into the base configuration.

This idea could be done with the Mergue-SysmonXml.ps1? Or it could be modify to achieve this idea? In that case, what could I modify to try it?.

Best regards and thanks for your time and effort.

[olafhartong]

I think what you want can be done with the script, I'd try it for sure and see what happens :)