# sarvesh-dotcom/wazuh-sysmon-threat-detection architecture

> Architecture diagram of the GitHub repository sarvesh-dotcom/wazuh-sysmon-threat-detection, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/sarvesh-dotcom/wazuh-sysmon-threat-detection
- Repository: https://github.com/sarvesh-dotcom/wazuh-sysmon-threat-detection

## Overview

This repository documents a Windows endpoint-monitoring lab: simulated activity generates Sysmon telemetry, the Wazuh Agent forwards it to the Manager, and alerts are reviewed in the Dashboard. The checked-in configuration files support the endpoint setup. The README names the Wazuh Indexer and several detection scenarios, but no source excerpts show their detailed wiring, so those relationships are not inferred.

Main entry points: [`config/ossec.conf.txt`](https://github.com/sarvesh-dotcom/wazuh-sysmon-threat-detection/blob/main/config/ossec.conf.txt) (Agent Configuration), [`config/sysmonconfig.xml.txt`](https://github.com/sarvesh-dotcom/wazuh-sysmon-threat-detection/blob/main/config/sysmonconfig.xml.txt) (Sysmon Configuration)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_endpoint["Windows Endpoint"]
  node_activity["Windows Activities"]
  node_sysmon["Sysmon"]
  node_agent["Wazuh Agent"]
end

subgraph group_siem["Wazuh SIEM"]
  node_manager["Wazuh Manager"]
  node_indexer[("Wazuh Indexer")]
  node_dashboard["Wazuh Dashboard"]
end

subgraph group_configuration["Lab Configuration"]
  node_agentconfig["Agent Configuration<br/>[ossec.conf.txt]"]
  node_sysmonconfig["Sysmon Configuration"]
end

node_operator(("Lab Operator"))
node_analyst(("Lab Analyst"))

node_operator -->|"simulates"| node_activity
node_activity -->|"generates events"| node_sysmon
node_sysmon -->|"provides telemetry"| node_agent
node_agent -->|"forwards logs"| node_manager
node_manager -->|"alerts reviewed in"| node_dashboard
node_dashboard -->|"presents alerts"| node_analyst
node_agentconfig -->|"configures"| node_agent
node_sysmonconfig -->|"configures"| node_sysmon

click node_agentconfig "https://github.com/sarvesh-dotcom/wazuh-sysmon-threat-detection/blob/main/config/ossec.conf.txt"
click node_sysmonconfig "https://github.com/sarvesh-dotcom/wazuh-sysmon-threat-detection/blob/main/config/sysmonconfig.xml.txt"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_activity,node_sysmon,node_agent toneBlue
class node_manager,node_indexer,node_dashboard toneAmber
class node_agentconfig,node_sysmonconfig toneMint
class node_operator,node_analyst toneIndigo
```

## Components

### Windows Endpoint

- **Windows Activities**
- **Sysmon**
- **Wazuh Agent**

### Wazuh SIEM

- **Wazuh Manager**
- **Wazuh Indexer**
- **Wazuh Dashboard**

### Lab Configuration

- [Agent Configuration](https://github.com/sarvesh-dotcom/wazuh-sysmon-threat-detection/blob/main/config/ossec.conf.txt): `config/ossec.conf.txt`
- [Sysmon Configuration](https://github.com/sarvesh-dotcom/wazuh-sysmon-threat-detection/blob/main/config/sysmonconfig.xml.txt): `config/sysmonconfig.xml.txt`

### Other components

- **Lab Operator**
- **Lab Analyst**

## Connections

- Lab Operator → Windows Activities: simulates
- Windows Activities → Sysmon: generates events
- Sysmon → Wazuh Agent: provides telemetry
- Wazuh Agent → Wazuh Manager: forwards logs
- Wazuh Manager → Wazuh Dashboard: alerts reviewed in
- Wazuh Dashboard → Lab Analyst: presents alerts
- Agent Configuration → Wazuh Agent: configures
- Sysmon Configuration → Sysmon: configures