Sysmon
ATTENTION:
Sysmon log collection is available exclusively with the Tracking licence.
BusinessLog supports the collection of events generated by Sysmon (System Monitor), a tool developed by Microsoft Sysinternals that extends the event logging capabilities of Windows.
Unlike traditional system logs, Sysmon records much more detailed information about the activities performed by the operating system. This makes it possible to monitor events such as process creation and termination, driver loading, WMI events, direct disk access, and many other operations useful for auditing and security activities.
The integration with BusinessLog makes it possible to collect these events automatically and make them available for consultation and analysis directly within the application.
Once Sysmon has been installed and configured, the events are automatically collected by BusinessLog and can be viewed in the new Sysmon Log List archive, available in the Log Archives section.
The grid allows you to view the recorded events, apply filters, and quickly search for the information you need.
BusinessLog automatically configures Sysmon to record the main system events, including:
​
-
ID 1 – Process creation
-
ID 5 – Process termination
-
ID 6 – Driver loading
-
ID 8 – Remote thread creation
-
ID 9 – Raw disk access
-
ID 19, 20 and 21 – WMI events
-
ID 25 – Process tampering
-
ID 29 – Detection of new executable files
Installation and Configuration
To use this feature, Sysmon must be installed on the machines to be monitored.
Two installation methods are available.
​
Manual installation
​
The installation is performed locally on the machine to be monitored using PowerShell started with administrator privileges.
This method can also be used on RT clients.
See the Sysmon manual installation procedure
​
Remote deployment
​
BusinessLog allows the Sysmon installation and configuration to be deployed automatically to remote machines using PowerShell and WinRM.
This method is suitable for the centralised configuration of machines within the corporate network.
See the Sysmon remote deployment procedure.
​
NOTE: Sysmon is also supported on RT clients.
However, on these clients, the PowerShell command cannot be remotely propagated through WinRM.
Sysmon must therefore be installed and configured locally by following the manual procedure.
Database
The collected events are stored in the new dbSysmon.vdb6 database, located in the BusinessLog database folder.
BlogTools has also been updated to support the management of the new database with the same functionality available for the other archives.
ATTENTION:
Sysmon event logging can generate a very large volume of data.
As a guideline, a typical workstation generates approximately 50,000–60,000 events per day, while a server can generate at least ten times as many.
It is therefore recommended to enable this feature only when genuinely required and on appropriately sized systems.