SysmonConfigPusher v2

A web-based tool for managing Sysmon configurations across Windows endpoints — supports both agentless (WMI/SMB) and agent-based deployments.

---

Features

Feature	Description
Agentless Deployment	Push Sysmon binaries and configs via WMI and SMB
Agent Support	Lightweight agent for cloud VMs and DMZ servers
Docker Support	Run on Linux/Docker for agent-only deployments
Web Interface	Modern React UI with real-time deployment progress
Event Log Viewer	Query Sysmon logs from remote hosts
Noise Analysis	Identify high-volume events to tune configurations
Scheduled Deployments	Schedule deployments for future execution
Flexible Auth	Windows Integrated Auth or API keys

Screenshots

Dashboard	Inventory

Config View	Config Editor

Deployment Wizard	Deployment Progress

Schedule Deployments	Noise Analysis

Quick Start

Option 1: MSI Installer (Windows Server)

1. Download the latest SysmonConfigPusher.msi
2. Run the installer as Administrator
3. Configure a domain service account (see docs)
4. Start the service and access the web UI (default port: 5001, configurable in appsettings.json)

Option 2: Docker (Agent-Only Mode)

docker run -d --name sysmonpusher \
  -p 5001:5001 \
  -v sysmonpusher-data:/data \
  -e API_KEY_ADMIN="your-admin-key" \
  -e AGENT_TOKEN="your-agent-token" \
  ghcr.io/antonlovesdnb/sysmonconfigpusher2:latest

Access the UI at https://localhost:5001 (self-signed certificate warning expected).

See Docker Guide for full configuration options.

Option 3: Build from Source

See the Development Guide for building and running locally.

Documentation

Guide	Description
Installation Guide	Production deployment on Windows Server
Usage Guide	How to use the application, config tagging (SCPTAG)
Agent Guide	Deploying and managing the lightweight agent
Docker Guide	Container deployment, backup, and recovery
Certificate Guide	TLS configuration for server and agents
Deployment Modes	Full vs Agent-Only mode comparison
Development Guide	Building from source, running locally

Requirements

Full Mode (Windows Server)

• Server: Windows Server 2016+ (domain-joined)
• Service Account: Domain account with local admin rights on target endpoints
• Network Ports: TCP 135 (WMI), 445 (SMB), 49152-65535 (RPC dynamic)

Agent-Only Mode (Docker/Linux)

• Server: Any platform with Docker or Linux
• Agents: Windows endpoints with agent installed (Agent Guide)
• Network: Agents connect outbound to server on HTTPS (port 5000/5001)

See Deployment Modes for a detailed comparison.

Architecture