trustedsec / trustedsec/SysmonCommunityGuide
Example usage of is-any feature new to sysmon v11.0
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.4k
- Forks
- 186
- PR merge metrics
- No merged PRs in 30d
Description
In Sysinternals Video Update for June 2020 on Youtube, minute 4:45 describes a new feature of sysmon v11 providing new "is-all" filtering condition as ability to specify multiple conditions and require all of them to be satisfied before an event is logged.
Sysmon (v12) schema shows these filters which are new to me:
is,is not,contains,contains any,is any,contains all,excludes,excludes any,excludes all,begin with,end with,less than,more than,image
The video does not provide an example of usage of these (these) new filtering options. I think it would be helpful to document usage here so folks (like me) can get up and running with it faster.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked Sysinternals video at 4:45 and the Sysmon v12 schema filters listed in the issue. Add practical configuration examples showing the new filtering options and place them in the relevant guide section; done means readers can understand how to use these conditions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- xml
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100