All Apps and Add-ons

Still supported to deploy latest Sysmon 10.x version?

Daniel_K
Explorer

Hi Olaf,

Looking into to use "Sysmon deploy and maintain" to deploy latest Sysmon 10.x version.
Should this work flawless or are any issues to be expected?

Best Regards,
Daniel

mhessel
Path Finder

This does work with the latest version of sysmon (10.42 at the moment).

I did have to make a few changes to enable this:

  • download the latest version of sysmon, extract all the files into TA-sysmon-deploy\bin ( should be sysmon.exe, sysmon64.exe, and eula)
  • edit the deploy.bat file, replace all of the instances of "System Monitor v8.00" with "System Monitor v10.42"
  • generate an updated config.xml file for this version, you can pull the latest updates from the git repo "https://github.com/olafhartong/sysmon-modular"

I did get some errors at times in the script where it would report a failure on upgrading the sysmon executable, but when I manually verified, the installation was successful and it was a false negative.

you will probably need to restart the splunkforwarder service after each sysmon upgrade, as the forwarder doesn't pick up the new event log entries without a restart.

0 Karma

cpaul8
New Member

Sysmon deploy and maintain works with version 10. it does nothing but pushing the binary and config file you upload into it provided the update.bat is updated with correct "system monitor vXX" string.

however, what I noticed recently is that TA for verison 10 has some field mapping issue with verison 10 and is not compliant with Endpoint DM in Enterprise Security. Please let me know if I am wrong.

0 Karma

ivanreis
Builder

Per what is being described on the app documentation, the current Sysmon deploy and maintain is developed to support Sysmon 8.00.
Release Notes
Version 1.16
July 25, 2018
Updated sysmon config generated from my modular repository.
This config is updated to the latest iteration of the MITRE ATT&CK framework
Built for Sysmon 8.00

I suggest to deploy this app to a Splunk sandbox environment and run your tests to check about the Sysmon behavior on verson 10.x. I never worked with this app before.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...