Alternatives to Sysmon
A Sysinternals service that logs detailed process, network and file activity to the Windows event log. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Sysmon
A Sysinternals service that logs detailed process, network and file activity to the Windows event log.
Replacements
Listings that take over the same core job as Sysmon.
Wazuh Agent
Endpoint agent that feeds a Wazuh server with security and compliance data.
Wazuh Agent is open source under GPL-2.0 and adds file integrity monitoring and rootkit detection, but requires a Wazuh manager and indexer to be useful.
Velociraptor
Endpoint monitoring and digital forensics platform driven by a query language.
Velociraptor is an AGPL-3.0 endpoint monitoring and forensics platform with its own query language, running on Windows, macOS and Linux, and needing fleet deployment planning.
Similar software
Related functionality, not a direct replacement.
Chainsaw
Search Windows forensic records for suspicious activity.
Hayabusa
Build investigation timelines from Windows event logs.
Autoruns
A Sysinternals utility that shows every program and driver configured to start automatically on Windows.
Tracee
A Linux runtime security and forensics tool that traces system events using eBPF.
Tetragon
An eBPF-based security observability and runtime enforcement tool for Linux hosts and Kubernetes clusters.
Falco
Detect unusual runtime behavior on Linux systems.
