EDR/XDR -- Sysmon

Sysmon Configuration Generator

Generate a production-ready sysmonconfig.xml tuned to your environment. Select your noise tolerance, enable the event types you need, and add environment-specific exclusions. No more copy-pasting configs you don't understand.

Noise preset

Minimal — Critical events only. Low volume, suitable for resource-constrained endpoints. Covers the top 10 high-fidelity detections.

Balanced (recommended) — Good coverage with tuned exclusions for Windows noise. ~2,000 events/day per endpoint. Based on SwiftOnSecurity baseline.

Verbose — Maximum coverage. High volume (~8,000 events/day). For environments with SIEM capacity to handle it. Recommended for DCs and critical servers.

Event types to include

Environment additions

Add exclusions for common AV/EDR processes (Defender, CrowdStrike, SentinelOne) Add exclusions for SCCM/Intune management agent Add exclusions for common backup agents (Veeam, Commvault) Add exclusions for developer tools (VS Code, Git, npm, Python)

Generated config

Click Generate to build your config...

Deployment commands

Install with config

sysmon64.exe -accepteula -i sysmonconfig.xml

Update existing config

sysmon64.exe -c sysmonconfig.xml

Verify running

Get-Service Sysmon64 | Select Status

Check event log

Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 10