3 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
This tool manages Sysmon configurations for Windows endpoints, supporting both agentless and agent-based deployments. It offers a web interface for real-time updates, event log querying, and noise analysis to optimize logging configurations.
If you do, here's more
SysmonConfigPusher2 is a web-based tool designed for managing Sysmon configurations on Windows endpoints. It allows for agentless deployments using WMI and SMB, as well as agent-based setups for cloud VMs and DMZ servers. The tool can run on Docker, making it versatile for different environments. Its modern React-based UI provides real-time deployment progress and features like an event log viewer and noise analysis for tuning configurations.
To set it up, users need to download the SysmonConfigPusher.msi and run the installer with administrator privileges. Configuration requires a domain service account with local admin rights on target endpoints. The web interface operates on port 5001 by default, and instructions for Docker deployment are straightforward, involving a single command to run the container with necessary environment variables.
The backend uses ASP.NET Core and SQLite for data management, while the frontend is built with React and TypeScript. The system also supports real-time updates via SignalR. Network requirements include specific TCP ports for WMI, SMB, and HTTPS connections, ensuring secure communication between the server and agents. The project is open for contributions under the MIT License, marking a significant upgrade from the original WPF application.
Questions about this article
No questions yet.