# Sysmon (System Monitor)

> Master Sysinternals Sysmon for deep system telemetry. Explore its architecture, critical event IDs for threat hunting, and how to deploy community configurations to catch advanced malware.

Canonical: https://codelivly.com/rooms/sysmon-system-monitor
Last updated: 2026-07-02

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Lessons | 3 |
| Estimated time | 30 min |
| XP | 200 |

Dive into the most powerful native telemetry tool for Windows. The Sysmon (System Monitor) module breaks down how to capture deep, high-fidelity system activity that standard Windows logs miss.

You will learn the architecture of Sysmon, how to configure it using XML, and master the critical Event IDs (like Process Creation, Network Connections, and File Creation) used by threat hunters to detect advanced malware, lateral movement, and persistence. By the end of this module, you will know how to deploy, tune, and leverage Sysmon for enterprise-grade incident response and threat hunting.

## Lessons

1. Introduction to Sysmon & Installation (30 min)
2. Writing and Applying Sysmon Configuration (30 min)
3. Critical Sysmon Event IDs (30 min)

## Related

- [Learning path: Windows Fundamentals](https://codelivly.com/learning-paths/windows-fundamentals)
- [All rooms](https://codelivly.com/rooms)