• Watch
  • Listen
  • Live Stream
Security Weekly
Security Market Validation
  • Listeners
    • Subscribe
    • Insider List
    • Suggest a Guest
  • Shows
    • Paul’s Security Weekly
    • Enterprise Security Weekly
    • Business Security Weekly
    • Application Security Weekly
    • Security & Compliance Weekly
    • Security Weekly News
    • Tradecraft Security Weekly
    • Secure Digital Life
  • Series
    • CISO Stories
  • Webcasts/Trainings
    • Registration
    • On-demand
  • Articles
  • Partners
    • Become a Partner
    • Landing Pages
    • Bookings
      • Approved Interview Form
      • Approved Interview Form – Returning Guest
      • Conference Collection Form
  • Hosts
  • Company
    • About
    • Contact
    • Careers

Articles/ Asset Management/ Blue Team/ Compliance/ Configuration Management/ Endpoint Security/ Exploit Prevention/ Identity and Access/ Incident Response/ Insider Threat/ Intrusion Detection/ Security Operations/ SIEM/ Threat Hunting

Sysmon Endpoint Monitoring: Do You Really Need an EDR?

Matt Alderman November 3, 2020

The endpoint market has been hot for years.  At one point, there were over 80 new endpoint vendors trying to displace the traditional anti-virus vendors.  The endpoint security market was transitioning from endpoint protection to endpoint detection and response (EDR).  EDR is all the rage, but do you really need one?

While the endpoint market has been on fire, Microsoft has been quietly advancing its endpoint capabilities with Microsoft Defender Advanced Threat Protection (ATP) and System Monitor (Sysmon).  Either (or both) of these sensors, integrated with a sophisticated Security Analytics (i.e., next-generation Security Incident & Event Management (SIEM)) brain, and you have a pretty advanced endpoint detection and response platform.

To demonstrate what I mean, we recently had Corey Thuen, founder at Gravwell, present a technical segment on Paul’s Security Weekly specifically talking about Sysmon endpoint monitoring.  By integrating Sysmon events into Gravwell’s Data Fusion Platform via their new Sysmon Kit, you can collect and monitor the following event types and key properties:

  • Process creation, including these key properties:
    • Computer
    • ProcessId
    • ProcessGuid
    • Image
    • OriginalFileName
    • Description
    • CommandLine
    • User
    • Hashes
    • ParentImage
    • ParentProcessId
    • ParentCommandLine
  • Network creation, including these key properties:
    • Computer
    • Image
    • SourceIp
    • SourceHostname
    • SourcePort
    • DestinationIp
    • DestinationHostname
    • DestinationPort

And that’s just to start…. Sysmon v12 also generates the following events:

  • A process changed a file creation time
  • Sysmon service state changed
  • Process terminated
  • Driver loaded
  • Image loaded
  • CreateRemoteThread
  • RawAccessRead
  • ProcessAccess
  • FileCreate
  • RegistryEvent (Object create and delete, Value Set, Key and Value Rename)
  • FileCreateStreamHash
  • ServiceConfigurationChange
  • PipeEvent (Pipe Created, Pipe Connected)
  • WmiEvent (WmiEventFilter activity detected, WmiEventConsumer activity detected, WmiEventConsumerToFilter activity detected)
  • DNSEvent
  • FileDelete
  • Error

That’s a lot of telemetry from a free endpoint monitoring tool.  And powering the rock-solid decisions of this telemetry?  Gravwell – Skip the collection hurdle, champion data unity, and accelerate powerful decisions.

To get a deeper dive, watch the technical segment on Paul’s Security Weekly here.  Or visit securityweekly.com/gravwell for more information.

Share this:

  • Click to share on Twitter (Opens in new window)
  • Click to share on LinkedIn (Opens in new window)
  • Click to share on Facebook (Opens in new window)

Related Posts

linux security

Articles /

How to Defend Linux from Attacks

tea leaves

Asset Management /

Reading the Application Security Tea Leaves – How to Interpret the Analyst Reports

Behavior Detections

Blue Team /

How Behavioral Detections Actually Discovered the SolarWinds Orion SUNBURST Attack

‹ What Security Data Do I Really Need to Collect and Analyze? › Protecting Cloud-Native Applications

About Security Weekly

Security Weekly is the security podcast network for the security community, distributing free podcasts and media since 2005. We connect the security industry and the security community through our security market validation programs.

More Than Just A Sponsor

We view our relationships with the security industry as partnerships, not sponsorships. Security Weekly works closely with each partner to help you achieve your marketing goals and gain traction in the security market. Interested in becoming a partner? Please visit our partnerships page.

Back to Top

Subscribe To The Blog:

RSS Feed RSS - Posts

Search

Follow Us On Twitter

→ Follow Us
© Security Weekly 2021
Powered by WordPress • Themify WordPress Themes