Sysmon [1] is a popular monitoring tool on Windows. It is based on ETW and its custom driver and provides great details on what is happening in the system. To make the logs relevant, we need to configure it (SwiftOnSecurity created a good base config file [2]).
Yesterday, MS released the first version of Sysmon for Linux and made it open-source (MIT license)[3]. It is based on eBPF. In [4] they show how they use it in Azure to collect events from the Linux VMs.
Sysmon [1] is a popular monitoring tool on Windows. It is based on ETW and its custom driver and provides great details on what is happening in the system. To make the logs relevant, we need to configure it (SwiftOnSecurity created a good base config file [2]).
Yesterday, MS released the first version of Sysmon for Linux and made it open-source (MIT license)[3]. It is based on eBPF. In [4] they show how they use it in Azure to collect events from the Linux VMs.
- [1] https://docs.microsoft.com/en-us/sysinternals/downloads/sysm...
- [2] https://github.com/SwiftOnSecurity/sysmon-config
- [3] https://github.com/Sysinternals/SysmonForLinux
- [4] https://techcommunity.microsoft.com/t5/azure-sentinel/automa...