Skip to main content

Tuning Procedures

Pre-Deployment Tuning​

note

The /opt/tfplenum/agent_pkgs/sysmon/sysmonconfig.xml base config only exists on DIP Controllers configured IAW 262COS-DIP-SOP-001. This is the file deployed to hosts when using the TFPlenum host agent deployer.

  1. Retrieve the base config from the DIP Controller:

    scp root@controller:/opt/tfplenum/agent_pkgs/sysmon/sysmonconfig.xml ./sysmonconfig.xml

  2. Review intelligence and mission planning to identify known software in the environment that will generate noise:

    • Endpoint Detection and Response (EDR) tools (CrowdStrike, Carbon Black, SentinelOne, Defender for Endpoint, etc.)
    • Antivirus solutions
    • Backup agents
    • Monitoring or management agents (SCCM, Tanium, Rapid7, etc.)

  3. Add exclusion rules for identified software. See Config Reference and Common Exclusions sections for syntax and patterns.

  4. Test the modified config on a local Windows host before deploying:

    sysmon.exe -n -l -i .\sysmonconfig.xml -accepteula
    What -n -l do

    -n enables network connection logging. -l enables image (DLL) load logging. Including both during testing ensures the config is evaluated against the noisiest event types.

  5. Review the Windows Event Viewer (Microsoft-Windows-Sysmon/Operational) to confirm expected events are being generated and known-good noise is suppressed.

  6. Push the tuned config back to the DIP Controller for deployment:

    scp ./sysmonconfig.xml root@controller:/opt/tfplenum/agent_pkgs/sysmon/sysmonconfig.xml

Post-Deployment Tuning​

note

If TFPlenum was used to deploy Sysmon, updating the config requires following the Pre-Deployment workflow above — TFPlenum performs a full uninstall and reinstall of agents, so the master config on the controller must be updated.

  1. Identify noise sources from Kibana. Query the nmap or Winlogbeat indices for high-frequency Sysmon events and identify patterns in the Image, DestinationIp, TargetFilename, or other fields that represent known-good activity.

  2. Using the config currently deployed to the host, add exclusion rules for the identified noise. See Config Reference and Common Exclusions for syntax.

  3. Test the modified config locally:

    sysmon.exe -n -l -i .\sysmonconfig.xml -accepteula

  4. Apply the updated config to a single host first to validate:

    sysmon.exe -c .\sysmonconfig.xml

    This applies the new config without reinstalling Sysmon. EventID 16 will be logged confirming the update.

  5. Confirm the expected reduction in noise in Kibana before pushing the config to all hosts IAW 262COS-HA-SOP-001.

Verifying Applied Configuration​

To check what configuration is currently active on a host:

sysmon.exe -c

To dump the current schema (useful for checking supported event types and fields in the installed version):

sysmon.exe -s