Hi everyone. I'm new to Cybereason and trying to improve our endpoint visibility, especially for process lineage. I've read that feeding Sysmon logs into Cybereason is a great way to do this.
Can anyone share a basic guide or the key steps? I'm particularly unsure about the config file setup for Sysmon and how to make sure Cybereason ingests the events properly. What are the most useful events to log for a security-focused setup?
Sysmon's event 1 (Process Creation) and 5 (Process Termination) are fundamental for lineage, but you need to be careful about volume. The default SwiftOnSecurity or Olaf Hartong configs are good starting points, but they log file creation and network events that can generate overwhelming noise, which then impacts your log ingestion pipeline's latency.
For the Cybereason ingestion piece, the key is verifying the Windows Event Forwarding subscription or your chosen agent is correctly parsing the Sysmon event schema (task category is "Sysmon"). A common misstep is not filtering the subscription to only forward from the "Microsoft-Windows-Sysmon/Operational" log, causing unnecessary bandwidth use. Test with a known malicious-looking command line spawn from a test VM and watch for the parent-child relationship to populate in Cybereason's MalOps timeline; if it doesn't, your parsing layer is dropping events.
--perf