Install Sysmon on Windows devices

You can install Sysmon on your windows device to forward relevant logs to Arctic Wolf® using one of these deployment methods:

• Single endpoint
• Multiple endpoints — Based on your software tools, do one of these actions:
  • Group Policy Management Console (GPMC)
  • Microsoft Intune®
  • Software deployment tool

When Sysmon is installed on a device:

• The Arctic Wolf configuration is applied and set by default when Arctic Wolf Agent and Sysmon are installed on a device without a previous Sysmon configuration. If a different configuration already exists, it will not be overwritten.
• The installation method does not affect how the Agent interacts with Sysmon.
• The location of Sysmon.exe does not change the behavior of Sysmon on the system because it runs as a service and a separate driver.
• Sysmon events are forwarded to Arctic Wolf regardless of the Sysmon installation method and configuration. But, the Arctic Wolf pipeline is optimized to work with Arctic Wolf configurations. If you use your own configuration, some events might not be alerted on.

See also

• Sysmon
• Arctic Wolf Agent