windows-sysinternals-sysmon Image

windows-sysinternals-sysmon

Technical questions about Windows Sysinternals Sysmon.
question
niklas-sjogren avatar image
niklas-sjogren asked

Several Events not longer working in Sysmon 14.0?

windows-sysinternals-sysmon

0 Votes

0Answers

0 Comments

question
PeterAAlvarado-6599 avatar image
PeterAAlvarado-6599 asked saldana-msft edited

Error in Azure Sysmon Workbook project' operator: Failed to resolve table or column expression named 'process_create_whitelist

azure-monitor microsoft-sentinel windows-sysinternals-sysmon microsoft-graph-workbooks

This question has an accepted answer. Accepted

0 Votes

3Answers

0 Comments

question
ZeArioch avatar image
ZeArioch asked

Sysmon 13.34 on Win10 20H2 - bugs with concurrent file openings for writing, and with job objects

windows-sysinternals-sysmon

0 Votes

0Answers

0 Comments

question
DrewMiranda-7358 avatar image
DrewMiranda-7358 asked EugeneP-5222 commented

FileDeleteDetected doesn't work in Sysmon v13.34

windows-sysinternals-sysmon

0 Votes

1Answer

2 Comments

question
BigerlStefan-8870 avatar image
BigerlStefan-8870 asked NickNguyen-6083 commented

Sysmon v13.34 generate Windows bug check 0x0000003b on Server 2012R2

windows-sysinternals-sysmon windows-sysinternals-general

0 Votes

1Answer

1 Comment

question
MichaelN-3711 avatar image
MichaelN-3711 asked fkl-6070 answered

Process information missing from network connection events

windows-sysinternals-sysmon

0 Votes

3Answers

0 Comments

question
Hiwakarimi-9020 avatar image
Hiwakarimi-9020 asked Hiwakarimi-9020 commented

Sysmon 13.34: paren process name is missing

windows-sysinternals-sysmon

0 Votes

1Answer

0 Comments

question
JohnH-9861 avatar image
JohnH-9861 asked JohnH-9861 answered

Sysmon Event ID 14 only partially logging

windows-sysinternals-sysmon

0 Votes

1Answer

0 Comments

question
KishoreR-8691 avatar image
KishoreR-8691 asked dstaulcu edited

Sysmon - Event-12 EventType-CreateValue event only not triggered in event viewer

windows-server windows-sysinternals-sysmon

0 Votes

2Answers

0 Comments

question
TylerMontney-4362 avatar image
TylerMontney-4362 asked dstaulcu commented

Checksum for Sysmon download

windows-sysinternals-sysmon windows-sysinternals-general

0 Votes

1Answer

0 Comments

question
JoeDoe-8386 avatar image
JoeDoe-8386 asked dstaulcu edited

Sysmon 13.33: Parent Process GUID / Parent Process Image / Parent Process Command Line / Parent Process User in EID1 are empty after a while

windows-sysinternals-sysmon

4 Votes

4Answers

0 Comments

question
niklas-sjogren avatar image
niklas-sjogren asked dstaulcu commented

Sysmon 13.2x using huge amount of handles on servers?

windows-sysinternals-sysmon

0 Votes

5Answers

0 Comments

question
SimoneErrico-8664 avatar image
SimoneErrico-8664 asked dstaulcu edited

Sysmon Event ID 1 Company field

windows-sysinternals-sysmon

0 Votes

1Answer

0 Comments

question
AhmedHesham-3701 avatar image
AhmedHesham-3701 asked AhmedHesham-3701 commented

RamMap Windows 11 compatibility issue

windows-11 windows-sysinternals-sysmon windows-sysinternals-general

This question has an accepted answer. Accepted

0 Votes

3Answers

2 Comments

question
steviefaux avatar image
steviefaux asked steviefaux answered

Using sysmon to monitor a folder activity by a specific user

windows-sysinternals-sysmon

This question has an accepted answer. Accepted

0 Votes

3Answers

0 Comments

125 Posts
98 Users
27 Followers