top of page

Remote Deployment of Sysmon

BusinessLog allows Sysmon to be installed and configured automatically on remote machines using a PowerShell command executed through WinRM.

This method avoids the need to install Sysmon manually on each individual machine and can be used to centrally configure multiple workstations within the corporate network.

Requirements

Before proceeding, make sure that:

  • WinRM is enabled and correctly configured on the target machine;

  • the machine is reachable from the BusinessLog server;

  • the user account being used has the required administrative privileges;

  • the ConfiguraSysmonBusinessLog.ps1 script is present in the Sysmon subfolder of the BusinessLog installation;

  • any firewalls do not block the communications required by WinRM.

Scheduling the PowerShell Command

Open the screen used to schedule PowerShell commands and select the following template:

Configure Sysmon for BusinessLog

​

BusinessLog generates the following command:

& '{businesslogpath}\sysmon\ConfiguraSysmonBusinessLog.ps1' -ComputerName '{machine}'

​

In the command:

  • {businesslogpath} is replaced with the BusinessLog installation path;

  • {machine} is replaced with the name of the machine on which Sysmon must be installed and configured;

  • the -ComputerName parameter identifies the remote machine on which the procedure must be executed.

If necessary, set the command execution date and time using the controls available on the screen.

hgvfff.png

Operations Performed

The ConfiguraSysmonBusinessLog.ps1 script automatically performs the following operations on the specified machine:

  • The installation of Sysmon;

  • The creation and application of the BusinessLog configuration;

  • The enabling of the monitored events;

  • The activation of the Microsoft-Windows-Sysmon/Operational log.

​​

Once execution is complete, verify that the Sysmon service is installed and that new events are present in the corresponding operational log.

​

NOTE: Sysmon is also supported on RT clients. However, on these clients, the PowerShell command cannot be remotely deployed through WinRM. Sysmon must therefore be installed and configured locally by following the procedure described on the Manual Installation of Sysmon page.

Guide

bottom of page