Microsoft added Sysmon to Windows

Microsoft has finally kept its promise to integrate Sysmon – a system monitoring tool from the suite Sysinternals – directly into Windows, a move that should make life significantly easier for business administrators who were struggling with deploying and managing the utility across thousands of endpoints.

This functionality was integrated this week in Windows Insider builds 26300.7733 (Dev channel) and 26220.7752 (Beta channel).

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

Sysmon allows administrators to record system events via custom configuration files, filter for specific activity, and pipe the data into standard Windows event logs for collection by security tools and SIEM pipelines.

Mark Russinovich, a Microsoft technical partner and co-founder of Winternals, has repeatedly pointed out the lack of official customer support for Sysmon in production environments – a gap that this addition fills.

The feature is disabled by default and requires activation via PowerShell.

Microsoft states that any existing Sysmon installation should be uninstalled before enabling the embedded version.

Turn on

Open a PowerShell as administrator and run the following commands

Dism /Online /Enable-Feature /FeatureName:Sysmon

and

sysmon -i

newsbot

Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.