theopolis
04/03/2021, 8:03 PM{
"events": {
"disable_subscribers": [
"sysmon_wmievent_filtering_events"
]
}
}
manu
04/04/2021, 4:06 AM--enable_sysmon_events_publisher=false
--enable_sysmon_process_create_events_subscriber=false
theopolis
04/05/2021, 5:02 PMmanu
04/05/2021, 5:35 PM{
"events": {
"disable_subscribers": [
"sysmon_driver_loaded_events",
"sysmon_file_created_events",
"sysmon_image_load_events",
"sysmon_network_connection_events",
"sysmon_pipe_connected_events",
"sysmon_pipe_created_events",
"sysmon_process_accessed_events",
"sysmon_process_create_events",
"sysmon_process_tampering_events",
"sysmon_process_terminate_events",
"sysmon_remote_thread_events",
]
}
}
Whereas the default state of a subscriber would be disabled (default), when done via flags (osquery.flags).
In this case the vanilla config wouldn't need to describe anything about subscribers.
Unless the user wishes to turn specific subscribers on (this is opposite to what the config way is).
Also this seems to be similar theme in the current implementation.
So circling back for thoughts again ? 🙂