SysmonSearch Logo

SysmonSearch

0
Free
Visit Website

SysmonSearch makes event log analysis more effective and less time-consuming by aggregating event logs generated by Microsoft's Sysmon. System Overview: SysmonSearch uses Elasticsearch and Kibana (and Kibana plugin). Elasticsearch collects/stores Sysmon's event log. Kibana provides a user interface for Sysmon's event log analysis. The following functions are implemented as Kibana plugin: Visualizes Function - visualizes Sysmon's event logs to illustrate correlation of processes and networks. Statistical Function - collects the statistics of each device or Sysmon's event ID. Monitor Function - monitors incoming logs based on preconfigured rules and triggers alerts. StixIoC server allows adding search/monitor conditions by uploading STIX/IOC files. From StixIoC server Web UI, you can upload STIXv1, STIXv2, and OpenIOC format files. To try SysmonSearch, you can either install software to your own Linux environment with the provided instructions or use the Docker image. For more details, please refer to the SysmonSearch wiki documentation.

FEATURES

ALTERNATIVES

GrokEVT is a tool for reading Windows event log files and converting them to a human-readable format.

Free

A centralized tool for security monitoring and analysis that integrates various open source big data technologies.

Free

A compliant audit log tool that provides a searchable, exportable record of read/write events.

Free

Graylog offers advanced log management and SIEM capabilities to enhance security and compliance across various industries.

Commercial

Access a repository of Analytic Stories and security guides mapped to industry frameworks, with Splunk searches, machine learning algorithms, and playbooks for threat detection and response.

Free

Browse a library of EQL analytics now natively integrated in Elasticsearch.

Free

Python library and command line tools for log visualization with interactive plots.

Free

AlienVault OSSIM provides an all-in-one security management solution with asset discovery, vulnerability assessment, and SIEM capabilities.

Free

PINNED

ImmuniWeb® Discovery Logo

ImmuniWeb® Discovery

ImmuniWeb Discovery is an attack surface management platform that continuously monitors an organization's external digital assets for security vulnerabilities, misconfigurations, and threats across domains, applications, cloud resources, and the dark web.

Attack Surface Management
InfoSecHired Logo

InfoSecHired

An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.

Resources
Mandos Brief Newsletter Logo

Mandos Brief Newsletter

A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.

Resources
Checkmarx SCA Logo

Checkmarx SCA

A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.

Application Security
Check Point CloudGuard WAF Logo

Check Point CloudGuard WAF

A cloud-native web application and API security solution that uses contextual AI to protect against known and zero-day threats without signature-based detection.

Application Security
Orca Security Logo

Orca Security

A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.

Cloud Security
DryRun Logo

DryRun

A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.

Application Security
Wiz Logo

Wiz

Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.

Cloud Security