What it does
Sysmon is a resident Windows monitoring service that logs process, connection and other system events for collection and security analysis.
Sysmon creates endpoint evidence for another process to analyze. Choose its event configuration before rollout: Microsoft's default-install example explicitly has no network monitoring, while a configuration file selects the intended behavior. Collect the generated Windows events through Event Collection or a SIEM agent and assign someone to review detections built on them. Decide which process and network questions the logs should answer and how long the resulting data is retained. Installing the logging service alone is not a completed monitoring program.
Strengths
- Detailed process and system-event telemetry
Watch out for
- Does not analyze the events it generates
Best for
- Defenders building endpoint evidence into an analysis pipeline
Sources
- Sysmon - Sysinternals | Microsoft Learn (Oct 26, 2026)