Overview

This article explains how to install and configure Sysmon.  Sysmon is a service and device driver, that once installed on a system, logs indicators that can greatly help track malicious activity in addition to help with general troubleshooting. It is a part of popular set of troubleshooting tools called Sysinternals, the creation of none other than Mark Russonivich, Microsoft’s CTO of Azure.

...

Sysmon Configuration: Sysmon_configuration.xml

Instructions

Follow these stepsPort  5154 needs to be allowed from the firewall.

Steps Of Configuration

1. Download both Sysmon and the Sysmon configuration. The configuration is a locally hosted xml file.
2. Extract Sysmon to a directory and place the configuration.xml in the same directory.
3. Open Windows command prompt in 'Run as Administrator' mode and navigate to the sysmon directory.
4. Use the following command to install and enable the sysmon service. - .\Sysmon.exe -i .\config_v14.xml -accepteula

     Wait for Install to finish.

...

VERIFICATION OF CONFIGURATION

Verification can be done either from CCE Server or from UI.

Using UI

STEP 1: Login to UI >> SYSTEM

Image Added

STEP 2: >> LOGS AND FLOWS COLLECTION STATUS .

Image Added

STEP 3: >>Inside SOURCE DEVICE IP, IP will reflect.

Image Added

Using CCE SERVER

“sudo tcpdump -i any host 5154 and host <IP address> -AAA” command should be ran on CCE server to check whether or not we are getting logs .