Windows Security Setup: Wazuh, Sysmon and Sysinternals in One Command
A PowerShell script that enrolls a Windows host into Wazuh and installs Sysmon and the Sysinternals Suite in one elevated command.
Project Overview
Bringing a Windows machine into security monitoring usually means three separate installs and a lot of clicking. This script does it in one elevated PowerShell command: it installs and registers the Wazuh agent, installs the Sysinternals Suite, and installs Sysmon with a chosen configuration.
Implementation Process
- Parameters for the Wazuh manager, registration password, agent group, agent name and agent version.
- Sysmon configuration choice: SwiftOnSecurity's sysmon-config (default), Olaf Hartong's sysmon-modular, or a custom URL.
- Sysinternals Suite installed to
C:\Program Files\Sysinternals\. - Supports Windows 10/11 and Windows Server 2016/2019/2022 with PowerShell 5.1+.
Results
A host ends up with the Wazuh agent shipping logs and security events to the manager, and Sysmon recording process creation, network connections and file operations in the Windows event log.
Benefits
- Repeatable onboarding of new endpoints.
- Consistent Sysmon coverage across hosts.
- Troubleshooting tools are already present when an incident starts.
Conclusion
Endpoint visibility is only as good as its coverage; making enrollment one command makes full coverage realistic.
Contents
Related Projects
Interested in more security projects?
Explore my other security implementations and solutions.
View All Projects