SysmonTools: Open Source Monitoring & Observability

What is SysmonTools?

SysmonTools is a collection of open-source utilities for analyzing, visualizing, and managing Microsoft Sysmon logs, aimed at security analysts, DFIR specialists, and threat hunters who work with Windows endpoint telemetry.

What it is

SysmonTools is a GPL-3.0 licensed project, written in TypeScript, that collects utilities for working with Microsoft Sysmon event logs. Its main component, Sysmon View, is a desktop application that tracks and visualizes Sysmon logs by logically grouping and correlating events using executables, session GUIDs, event creation times, and other fields. Version 2.0 rewrote Sysmon View from the ground up with Electron, React, and TypeScript, making the whole codebase open and free of commercial dependencies.

The problem it solves is the gap between raw Sysmon output and usable analysis. Sysmon produces dense event streams, and an analyst looking at one suspicious process GUID must reconstruct a session by hand. Sysmon View replaces that manual correlation with an interactive diagram in which each node is a Sysmon event, color-coded by type and showing the field of interest: command lines, network connections, loaded images, or registry keys. It lives in the Windows endpoint monitoring and threat-hunting ecosystem, alongside Sysinternals and the Sysmon driver itself, and operates on the logs those tools generate.

Key capabilities

Process View summarizes run sessions per process GUID and renders correlated events as an interactive session diagram with collapsible nodes, event type filtering, and pin mode with a configurable context range.
Session threshold protection redirects sessions with over 2,000 events to the All Events view, and large datasets use server-side pagination.
Map View geo-locates network destinations through configurable GeoIP providers and plots them on an interactive map; clicking a marker pivots into correlated events for that destination.
All Events View provides full search with hierarchical grouping, so dragging column headers groups by machine, event type, session GUID, or any combination.
Event Details opens on double-click and shows every field from the event-specific table, with direct VirusTotal report links for MD5, SHA1, and SHA256 hashes and for IP addresses.
VirusTotal integration covers hash and IP lookups: direct VT report links need no API key, while detailed results require one.
Dark-themed analyst UI with cross-platform potential, Windows first and macOS and Linux possible.

Who uses it and how

Security analysts investigating a suspicious process use Process View to pull every correlated event for a process GUID into one diagram instead of pivoting across raw log queries.
DFIR specialists reconstructing an intrusion follow session diagrams, collapsing and expanding sections of the event chain, and pinning the events that matter while filtering the rest out.
Threat hunters doing network triage use Map View to see where a host connected, then click a destination marker to inspect the events behind that connection.
Analysts working through large collections rely on server-side pagination and hierarchical grouping in All Events for volumes a session diagram cannot render.
Enrichment-minded teams link out to VirusTotal reports for file hashes and IP addresses straight from the event detail panel.

Getting started

The README documents a Getting Started section and a Building from Source section, so the described path is to build the Electron, React, and TypeScript application from source. A Legacy Tools section covers the pre-2.0 utilities.

How it compares

No comparable projects are named in the facts available here, so SysmonTools stands alone in this registry. It integrates with VirusTotal for hash and IP enrichment and with configurable GeoIP providers for the map view, rather than competing with them.

When to use it — and when not to

Choose SysmonTools when the work is Windows endpoint log analysis and the team wants an open, GPL-3.0 desktop application free of commercial dependencies, built from source. Do not pick it if the environment is not Windows, since macOS and Linux support is described only as possible, or if analysis depends on very large single sessions, because sessions above 2,000 events are redirected out of the diagram view. Detailed VirusTotal enrichment requires an API key, so teams that cannot supply one get only the direct report links.

project readme (upstream, from github) — read inline

Sysmon Tools

GitHub last commit

A collection of utilities for analyzing, visualizing, and managing Microsoft Sysmon logs — designed for security analysts, DFIR specialists, and threat hunters.

What's New in v2.0

Sysmon View has been rewritten from the ground up as a fully open-source desktop application — a long-requested change by the community. Built with Electron + React + TypeScript, the entire codebase is now open and free of commercial dependencies.

Key improvements:

Modern dark-themed UI with a streamlined analyst workflow
Interactive session diagrams with freedom to move and arrange nodes
Collapsible nodes — collapse/expand sections of the event chain for focused analysis
Event type filtering — show/hide specific event types for a zoomed-in view of what matters
Pin mode — pin events of interest and filter to show only pinned events with configurable context range
Performance optimization — server-side pagination for large datasets, session threshold protection for diagram rendering
Hierarchical grouping in All Events — drag columns to group by machine, event type, session GUID, or any combination
Direct VirusTotal report links for hashes and IP addresses (no API key required for basic lookups)
GeoIP map view with multiple provider support
Cross-platform potential (Windows first, macOS/Linux possible)

Sysmon View

Sysmon View helps track and visualize Sysmon logs by logically grouping and correlating events. It uses executables, session GUIDs, event creation times, and more to organize data into multiple views.

Sysmon View

Process View

Summarizes run sessions per process GUID and shows correlated events in an interactive session diagram. Each node represents a Sysmon event, color-coded by type, displaying the field of interest (command lines, network connections, loaded images, registry keys, etc.).

Collapsible nodes — collapse/expand sections of the event chain to focus on what matters
Event type filter — show/hide specific event types (e.g., hide Image Loaded to focus on network events)
Pin mode — pin important nodes and filter to show only pinned events with configurable context range
Session threshold — sessions with over 2,000 events redirect to All Events for performance

Process View

Map View

Geo-locates network destinations using configurable GeoIP providers and plots them on an interactive map. Click any marker to pivot into correlated events for that destination.

Map View

All Events View

Full search through all collected data with server-side pagination for large datasets. Supports hierarchical grouping — drag column headers to the group zone to organize by machine, event type, session GUID, or any combination.

All Events View

Event Details

Double-click any event to open a detail panel showing all fields from the event-specific table. Includes direct links to VirusTotal reports for hashes (MD5, SHA1, SHA256) and IP addresses.

Event Details

Additional Features

VirusTotal API integration for hash and IP lookups (requires API key for detailed results)
Direct VT report links (no API key required) for quick browser-based analysis
Export Sysmon XML logs from Windows Event Log and import into Sysmon View
SQLite database backend — portable, shareable, and queryable with any SQLite tool

Getting Started

Download

Download the latest release from the Releases page:

Installer — Sysmon View Setup x.x.x.exe (recommended)
Portable — SysmonView-x.x.x-portable.exe (no installation required)

Export Sysmon Logs

Export Sysmon events to XML using WEVTUtil:

WEVTUtil query-events "Microsoft-Windows-Sysmon/Operational" /format:xml /e:sysmonview > eventlog.xml

Import into Sysmon View

Launch Sysmon View
Go to File > Import XML Logs and select one or more exported XML files
Events are parsed and stored in a local SQLite database
Navigate between Process View, Map View, and All Events to analyze the data

The database is stored under your user application data folder and can be shared or backed up.

Building from Source

Prerequisites

Node.js v18 or later
Git

Development

git clone https://github.com/nshalabi/SysmonTools.git
cd SysmonTools/SysmonView
npm install
npm run dev

Production Build

cd SysmonTools/SysmonView
npm install
npm run build

The installer and portable executable will be generated in the SysmonView/release/ directory.

Legacy Tools

Previous versions of Sysmon Tools are archived in the Legacy/ directory:

Sysmon View v3.1 — the original desktop application
Sysmon Shell — GUI configuration editor for Sysmon XML configs
Sysmon Box — command-line utility to capture and correlate Sysmon + network events

These tools are provided as-is for reference. New versions may be added to this repository as they are rewritten.

Third-Party Libraries

Sysmon View is built with open-source libraries including React, Electron, React Flow, TanStack Table, Leaflet, sql.js, and others. See THIRD_PARTY_NOTICES.md for the full list with license details.

Support the Project

If you find Sysmon Tools useful in your work, consider supporting its continued development:

GitHub Sponsors

Your support helps keep the project maintained, open source, and free for the community.

License

This project is licensed under the GNU General Public License v3.0.

Contact

X (Twitter): x.com/nader_shalabi
LinkedIn: linkedin.com/in/nadershalabi

For issues or feature requests, please open an issue.

Frequently asked questions

Is SysmonTools free to use?

SysmonTools is open source under the GPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does SysmonTools do?

Utilities for Sysmon

What is SysmonTools written in?

SysmonTools is primarily written in TypeScript. Its source is publicly available at https://github.com/nshalabi/SysmonTools, and it has 1,669 GitHub stars.