# wazuh-sysmon

Companion files for the lesson **Sysmon with Wazuh for Windows Telemetry**:
<https://maheshtata.com/wazuh/wazuh-sysmon/>

Lab-verified 23 September 2026 against Wazuh 5.0.0-beta5 (official Docker
stack) with a Windows 11 Pro Arm64 endpoint, build 26200, running Sysmon
v15.22. Wazuh 5.0 is in beta. Re-check against the release documentation at GA.

| File | Where it goes |
| --- | --- |
| `install-sysmon.ps1` | Run elevated on the endpoint, in the folder holding the Sysmon binary for that architecture. Installs or reconfigures Sysmon from a configuration you have reviewed. |
| `localfile-sysmon.xml` | Inside the `<ossec_config>` element of `C:\Program Files (x86)\ossec-agent\ossec.conf`, before the last `</ossec_config>`. |
| `agent.conf` | `/var/wazuh-manager/etc/shared/windows/agent.conf` on the manager, for the whole Windows group. |
| `rule-sysmon-office-spawns-shell.yml` | Paste into the YAML editor at Security Analytics > Detection > Rules, in the draft space, linked to a custom integration. |
| `logtest-sysmon.json` | Log test request template. Paste a real Sysmon event into it. |

## Getting Sysmon

Sysmon ships as one zip holding every architecture:
<https://download.sysinternals.com/files/Sysmon.zip>

```powershell
Invoke-WebRequest -Uri "https://download.sysinternals.com/files/Sysmon.zip" -OutFile "$env:TEMP\Sysmon.zip"
Expand-Archive -Path "$env:TEMP\Sysmon.zip" -DestinationPath "$env:TEMP\Sysmon" -Force
```

It contains `Sysmon.exe` (32-bit), `Sysmon64.exe` (x64) and `Sysmon64a.exe`
(ARM64). The per-file links under `live.sysinternals.com` do not cover every
build: `https://live.sysinternals.com/Sysmon64a.exe` returns 404, so the zip is
the only route to the ARM64 binary. The Windows service is named after the
binary you run, `Sysmon64` or `Sysmon64a`, so do not hard-code the x64 name.

The Wazuh agent service on Windows is `WazuhSvc`, so reload the agent with
`Restart-Service WazuhSvc` after editing `ossec.conf`.

## No Sysmon configuration is shipped here

A Sysmon configuration is the whole engineering problem, and it changes faster
than a tutorial does. Take one from a primary source, read it, and commit your
edited copy to your own configuration repository:

- Sysmon itself: <https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon>
- SwiftOnSecurity `sysmon-config`: <https://github.com/SwiftOnSecurity/sysmon-config>
- Olaf Hartong `sysmon-modular`: <https://github.com/olafhartong/sysmon-modular>

The Wazuh 5.0-beta documentation walks the same installation using a
configuration hosted by Wazuh:
<https://documentation.wazuh.com/5.0-beta/user-manual/capabilities/log-data-collection/use-cases.html>

## Fields the decoder writes for Event ID 1

Confirmed on the beta5 lab, from a real process-creation event indexed into
`wazuh-events-v5-system-activity` by the standard `windows` integration
(decoders `core-wazuh-message`, `windows-event`, `windows-sysmon`):

`event.code` (string, `"1"`), `event.action` (`"started"`), `event.dataset`
(`"sysmon"`), `event.start`, `process.name`, `process.executable`,
`process.command_line`, `process.args[]`, `process.pid`, `process.entity_id`,
`process.working_directory`, `process.hash.md5`, `process.hash.sha256`,
`process.pe.{original_file_name,description,product,company,file_version,imphash}`,
`process.parent.{name,executable,command_line,args,pid,entity_id}`,
`user.{name,id,domain}`, `related.hash[]`, `related.user[]`,
`file.{directory,name,extension}` of the parent image, `host.name`, `log.level`.
There are no `winlog.*` fields.

The rule in this folder selects on `process.parent.name`, `process.name` and
`process.command_line`, all of which are populated.

## Before you promote the rule

If your content differs from the shipped `windows` integration, run
`logtest-sysmon.json` with a real event, read `normalization.output`, and adjust
the rule's selections to the field paths that come back. A rule that references
a field the decoder never sets validates fine and then never fires. Log test
runs only in the `test`, `custom` and `standard` spaces, so promote the Draft
integration first.

Note that on beta5 the shipped content produced no findings from benign Sysmon
activity: 730 Sysmon events on the lab endpoint, zero findings. The custom rule
is how you get a detection out of this channel today.