SysmonConfigPusher v2

A web-based tool for managing Sysmon configurations across Windows endpoints — supports both agentless (WMI/SMB) and agent-based deployments.

Features

Screenshots

Dashboard	Inventory

Config View	Config Editor

Deployment Wizard	Deployment Progress

Schedule Deployments	Noise Analysis

Quick Start

Option 1: MSI Installer (Windows Server)

Download the latest SysmonConfigPusher.msi
Run the installer as Administrator
Configure a domain service account (see docs)
Start the service and access the web UI (default port: 5001, configurable in appsettings.json)

Option 2: Docker (Agent-Only Mode)

docker run -d --name sysmonpusher \
  -p 5001:5001 \
  -v sysmonpusher-data:/data \
  -e API_KEY_ADMIN="your-admin-key" \
  -e AGENT_TOKEN="your-agent-token" \
  ghcr.io/antonlovesdnb/sysmonconfigpusher2:latest

Access the UI at https://localhost:5001 (self-signed certificate warning expected).

See Docker Guide for full configuration options.

Option 3: Build from Source

See the Development Guide for building and running locally.

Documentation

Requirements

Full Mode (Windows Server)

Server: Windows Server 2016+ (domain-joined)
Service Account: Domain account with local admin rights on target endpoints
Network Ports: TCP 135 (WMI), 445 (SMB), 49152-65535 (RPC dynamic)

Agent-Only Mode (Docker/Linux)

Server: Any platform with Docker or Linux
Agents: Windows endpoints with agent installed (Agent Guide)
Network: Agents connect outbound to server on HTTPS (port 5000/5001)

See Deployment Modes for a detailed comparison.

Architecture

┌─────────────────────────────────────────────────────────────────────┐
│                          Web Browser                                │
│              (Windows Auth or API Key Authentication)               │
└─────────────────────────────┬───────────────────────────────────────┘
                              │ HTTPS
                              ▼
┌─────────────────────────────────────────────────────────────────────┐
│                    SysmonConfigPusher Server                        │
│                (Windows Service or Docker Container)                │
│                                                                     │
│  ┌─────────────┐  ┌──────────────┐  ┌────────────────────────────┐  │
│  │  REST API   │  │ SignalR Hub  │  │  Background Workers        │  │
│  │  (Configs,  │  │ (Real-time   │  │  (Deployments, Scans,      │  │
│  │  Deploy)    │  │  Progress)   │  │   Scheduled Jobs)          │  │
│  └─────────────┘  └──────────────┘  └────────────────────────────┘  │
│  ┌────────────────────────────────────────────────────────────────┐ │
│  │                    SQLite Database                             │ │
│  │    (Configs, Inventory, Deployments, Audit Log)                │ │
│  └────────────────────────────────────────────────────────────────┘ │
└───────────────────┬─────────────────────────────┬───────────────────┘
                    │                             │
        WMI + SMB   │                             │  HTTPS (Agent API)
      (Full Mode)   │                             │  (Agent-Only Mode)
                    ▼                             ▼
┌───────────────────────────────┐   ┌───────────────────────────────┐
│     Domain Endpoints          │   │     Cloud/DMZ Endpoints       │
│        (Agentless)            │   │      (Lightweight Agent)      │
│                               │   │                               │
│  • Direct WMI execution       │   │  • Agent polls for commands   │
│  • SMB file transfer          │   │  • Outbound HTTPS only        │
│  • Remote event log queries   │   │  • No inbound ports needed    │
└───────────────────────────────┘   └───────────────────────────────┘

Tech Stack

Lab Environment

Want to try this out in a lab environment? Check out the Constructing Defense Lab!

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

License

This project is licensed under the MIT License - see the LICENSE file for details.

Acknowledgments

This is a modernization of the original SysmonConfigPusher WPF application.

Agentless Deployment	Push Sysmon binaries and configs via WMI and SMB
Agent Support	Lightweight agent for cloud VMs and DMZ servers
Docker Support	Run on Linux/Docker for agent-only deployments
Web Interface	Modern React UI with real-time deployment progress
Event Log Viewer	Query Sysmon logs from remote hosts
Noise Analysis	Identify high-volume events to tune configurations
Scheduled Deployments	Schedule deployments for future execution
Flexible Auth	Windows Integrated Auth or API keys

Installation Guide	Production deployment on Windows Server
Usage Guide	How to use the application, config tagging (SCPTAG)
Agent Guide	Deploying and managing the lightweight agent
Docker Guide	Container deployment, backup, and recovery
Certificate Guide	TLS configuration for server and agents
Deployment Modes	Full vs Agent-Only mode comparison
Development Guide	Building from source, running locally

Backend	ASP.NET Core 8, Entity Framework Core, SQLite
Frontend	React 18, TypeScript, Tailwind CSS, Vite
Real-time	SignalR WebSockets
Deployment	Windows Service, Docker, MSI Installer (WiX)
Agent	.NET 8 self-contained Windows Service

SysmonConfigPusher2

Most Popular