- config適用して、splunk関連の起動プロセスのログが記録されなくするための参考。
- 本家SwiftOnSecurityのsysmon-configにSplunk関連のProcessCreationのみ除外(exclude)したものを用意
- 4.3以降は、olafhartong/sysmon-modularのルールを一部参考
- 4.5 (EventCode=23,24,25対応)
- 4.3 (EventCode=22対応)
- 4.0
forked from SwiftOnSecurity/sysmon-config
-
Notifications
You must be signed in to change notification settings - Fork 0
sysmon with excluding splunk proccess
odorusatoshi/sysmon-config
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
About
sysmon with excluding splunk proccess
Resources
Stars
Watchers
Forks
Releases
No releases published
Packages 0
No packages published