How sarvesh-dotcom/wazuh-sysmon-threat-detection works
This repository documents a Windows endpoint-monitoring lab: simulated activity generates Sysmon telemetry, the Wazuh Agent forwards it to the Manager, and alerts are reviewed in the Dashboard. The checked-in configuration files support the endpoint setup. The README names the Wazuh Indexer and several detection scenarios, but no source excerpts show their detailed wiring, so those relationships are not inferred.
Main entry points: ossec.conf.txt Agent Configuration · sysmonconfig.xml.txt Sysmon Configuration
Components 10
Windows Endpoint
- Windows Activities
- Sysmon
- Wazuh Agent
Wazuh SIEM
- Wazuh Manager
- Wazuh Indexer
- Wazuh Dashboard
Lab Configuration
- Agent Configuration
config/ossec.conf.txt - Sysmon Configuration
config/sysmonconfig.xml.txt
Other components
- Lab Operator
- Lab Analyst
Connections 8
- Lab Operator → Windows Activities: simulates
- Windows Activities → Sysmon: generates events
- Sysmon → Wazuh Agent: provides telemetry
- Wazuh Agent → Wazuh Manager: forwards logs
- Wazuh Manager → Wazuh Dashboard: alerts reviewed in
- Wazuh Dashboard → Lab Analyst: presents alerts
- Agent Configuration → Wazuh Agent: configures
- Sysmon Configuration → Sysmon: configures