Install with a top-level collection
2 collections include itsudo cscli collections install sigmahq/windows_proc_creationInstalls 1 parser and 520 scenarios.
View Windows - Suspicious Process Detection →Installation
sudo cscli parsers install crowdsecurity/sysmon-logsThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
onsuccess: next_stagefilter: "evt.Parsed.Channel == 'Microsoft-Windows-Sysmon/Operational'"name: crowdsecurity/sysmondescription: "Parse sysmon events"nodes:- filter: evt.Parsed.EventID == '1'statics:- parsed: ProcessGuidexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessGuid']")- parsed: Imageexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Image']")- parsed: ProcessIdexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ProcessId']")- parsed: FileVersionexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='FileVersion']")- parsed: Descriptionexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Description']")- parsed: Companyexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Company']")- parsed: OriginalFileNameexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='OriginalFileName']")- parsed: CommandLineexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='CommandLine']")- parsed: CurrentDirectoryexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='CurrentDirectory']")- parsed: Userexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='User']")- parsed: LogonGuidexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='LogonGuid']")- parsed: LogonIdexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='LogonId']")- parsed: TerminalSessionIdexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='TerminalSessionId']")- parsed: IntegrityLevelexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='IntegrityLevel']")- parsed: Hashesexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Hashes']")- parsed: ParentProcessGuidexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='ParentProcessGuid']")- parsed: ParentProcessId