Sysmon Deployment and Telemetry Health Audit
A procedure for verifying telemetry coverage integrity when Sysmon is deployed from scratch on a new group of systems or when a periodic health audit of an existing installation is performed.
Prepare
5 steps- Identify system profile
Determine which environment the endpoint belongs to: Domain Controller, workstation, server, legacy; a separate Sysmon config profile will be used for each profile — a single config is not applied to all systems.
- Config selection and versioning
As a starting point, derive an environment-specific profile from the SwiftOnSecurity/sysmon-config or olafhartong/sysmon-modular community baselines; version the config file via git or GPO and record its SHA256 integrity.
- Prepare WEF/agent infrastructure first
The log forwarding infrastructure (WEF subscription or SIEM agent) must be ready and tested before Sysmon installation; if the order is wrong, the first events generated during installation will be lost.
- Disk space assessment
If EID 23 (`ArchiveDirectory`) is enabled, copying deleted files creates a disk-fill risk; set `CopyOnDeletePE: false` or apply a space limit; EID 26 logs only the deletion with lower disk impact.
- Verify binary integrity
Compare the SHA256 value of `sysmon64.exe` against the official value downloaded from Microsoft Sysinternals; enter the SHA256 of the approved config into the change management record.