Windows Sysmon monitoring
Deploy pinned Sysmon monitoring and optionally stream Windows telemetry to Microsoft Sentinel.
Before you start
- Review the documented prerequisites and required permissions before deployment.
- Optional components are disabled by default.
Quick start
Use the reviewed commands below. See the repository documentation for prerequisites and detailed setup.
azd init -t nathanmcnulty/azd-sysmon
azd up
Deployment details
- Shape: standalone
- Source: 30fe2bc87be0d417151990a8714f81eb3ec5b84d
- Reviewed documentation: Source
Optional features
- Optional Sentinel, Intune, Defender, and Azure VM deployment targets.
These are documentation facts, not permission approval or proof of deployment or notification delivery.
Template details
- Repository:
azd-sysmon - Tags: Microsoft Sentinel, Sysmon, Windows Security
- Language: PowerShell
- Updated: Oct 15, 2026
- Variants: 1
Highlights
- Pins Sysmon configuration assets and reusable components
- Supports Azure VMs and Intune-managed Windows clients
- Verifies telemetry in Log Analytics before tuning
Notes
This guide page combines display metadata and separately reviewed source facts for azd-sysmon.