{"id":101654,"date":"2021-10-15T10:23:31","date_gmt":"2021-10-15T08:23:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kompaniya-microsoft-portirovala-sysmon-dlya-linux-i-otkryla-ego-kod"},"modified":"2021-10-15T10:23:31","modified_gmt":"2021-10-15T08:23:31","slug":"kompaniya-microsoft-portirovala-sysmon-dlya-linux-i-otkryla-ego-kod","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/kompaniya-microsoft-portirovala-sysmon-dlya-linux-i-otkryla-ego-kod","title":{"rendered":"Microsoft has ported Sysmon to Linux and opened its source code.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Microsoft has ported the Sysmon system activity monitoring service to the Linux platform. To track the operation on Linux, the eBPF subsystem is employed, allowing handlers to run at the operating system's kernel level. Additionally, the SysinternalsEBPF library is being developed, which includes functions useful for creating BPF handlers to monitor events in the system. The toolkit's code is open under the MIT license, while the BPF programs are licensed under GPLv2. Pre-built RPM and DEB packages suitable for popular Linux distributions are available in the repository packages.microsoft.com. <\/p>\n
Sysmon allows for logging detailed information about process creation and termination, network connections, and file manipulations. The log retains not only general information but also data beneficial for analyzing security-related incidents, such as the name of the parent process, hashes of executable file contents, information about dynamic libraries, details about file creation\/access\/modification\/deletion times, and data on direct process access to block devices. To limit the volume of logged data, filter settings are available. The log can be saved through the standard Syslog. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"