Using System Monitor to identify security issues

In this chapter, we've spent quite a bit of time looking at how to prevent things going wrong; using compliance checklists; delegating appropriate permissions; disabling old services and protocols. Earlier in this book, we also looked at using Windows Defender for anti-malware and crypto-ransom protection. But we haven't yet looked at things we can use to figure out what went wrong in the event that our planning wasn't effective.

System Monitor (Sysmon) is tool that, once installed, logs a lot of additional information about your system to your Windows Event Log. It is a very powerful tool when it comes to tracking down what went wrong and where and is very useful in the event that something security-wise does go wrong with your systems. If you have systems that log events to a central location, then you have even more power at your fingertips.

Getting started

All you'll need for this is a Windows Server...