Example usage of is-any feature new to sysmon v11.0
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 38/100
- Issue type
- Documentation
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- xml
- Domain
- documentation
Research direction
Start with the linked Sysinternals video at 4:45 and the Sysmon v12 schema filters listed in the issue. Add practical configuration examples showing the new filtering options and place them in the relevant guide section; done means readers can understand how to use these conditions.
Written by the indexing model from the issue text.
Description
In Sysinternals Video Update for June 2020 on Youtube, minute 4:45 describes a new feature of sysmon v11 providing new "is-all" filtering condition as ability to specify multiple conditions and require all of them to be satisfied before an event is logged.
Sysmon (v12) schema shows these filters which are new to me:
is,is not,contains,contains any,is any,contains all,excludes,excludes any,excludes all,begin with,end with,less than,more than,image
The video does not provide an example of usage of these (these) new filtering options. I think it would be helpful to document usage here so folks (like me) can get up and running with it faster.
- Dominant language
- Python
- Stars
- 1.4k
- Forks
- 186
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from trustedsec/SysmonCommunityGuide
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
Broken PDF Open
Difficulty 2/5 1-3 hours Newbie friendliness 35/100
-
Difficulty 3/5 1-2 days Newbie friendliness 42/100
trustedsec/SysmonCommunityGuide#31 · 3 comments ·
-
Difficulty 4/5 3-5 days Newbie friendliness 20/100
trustedsec/SysmonCommunityGuide#29 · 9 comments ·
-
Changelog Updates Open
Difficulty 2/5 1-3 hours Newbie friendliness 35/100
All issues in trustedsec/SysmonCommunityGuide
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
anthropics/skills#1811 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
speaches-ai/speaches#678 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
datalayer/mcp-compose#42 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
conda-forge/spacy-feedstock#177 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
UKGovernmentBEIS/inspect_evals#2523 ·