Sysmon – Log system activity to the Windows event log
technet.microsoft.com
Sysmon – Log system activity to the Windows event log
1–10 of 31 posts
Re: Sysmon – Log system activity to the Windows event log
#2The `value` in there makes me sad. It's better than the `` one of our partners uses at work but still...
If there's a good reason for it, it's just as much of a good reason XML isn't suitable for what you're trying to do.
Re: Sysmon – Log system activity to the Windows event log
#3The ` value ` in there makes me sad. It's better than the ` ` one of our partners uses at work but still... If there's a good reason for it, it's just as much of a good reason XML isn't suitable for what you're trying to do.
It's not a deal-breaker, but value would indeed be nicer.
Re: Sysmon – Log system activity to the Windows event log
#4The ` value ` in there makes me sad. It's better than the ` ` one of our partners uses at work but still... If there's a good reason for it, it's just as much of a good reason XML isn't suitable for what you're trying to do.
I can understand why they wouldn't have wanted to create an XSD covering all of the possible keys.
Re: Sysmon – Log system activity to the Windows event log
#5The ` value ` in there makes me sad. It's better than the ` ` one of our partners uses at work but still... If there's a good reason for it, it's just as much of a good reason XML isn't suitable for what you're trying to do.
It's not a deal-breaker, but value would indeed be nicer.
For a human to read maybe, but for some generic parsing where there are many diferent keys, I would say value is indeed better, also makes an XSD easier to create, if needed.
Re: Sysmon – Log system activity to the Windows event log
#6I am confused. Is this in fact new or has there been a new release. Sysmon has been around for a while, no?
Re: Sysmon – Log system activity to the Windows event log
#7I am confused. Is this in fact new or has there been a new release. Sysmon has been around for a while, no?
This is the first release of Sysmon. Perhaps you're thinking of Process Monitor?
Re: Sysmon – Log system activity to the Windows event log
#8The ` value ` in there makes me sad. It's better than the ` ` one of our partners uses at work but still... If there's a good reason for it, it's just as much of a good reason XML isn't suitable for what you're trying to do.
Free-form tag names invariably leads to conflicts with previously defined tags that are used for other purposes. I don't see how not wanting an unbounded number of different tags would be antithetical to use of XML.
Re: Sysmon – Log system activity to the Windows event log
#9This is great stuff.
As to the xml...im never going to read it. I'm going to shove it in azure tables and mine it with hindsight.