Sysmon Installer and Events Monitor - how the Insight Agent implements these components for use with InsightIDR and MDR

The Sysmon Installer and Events Monitor components included with supported Microsoft Windows-based Insight Agent deployments are responsible for collecting event log data for use with Rapid7's InsightIDR and MDR offerings.

This article explains the role played by each of these components in the Windows events data collection process, how they handle a variety of environmental factors, and what you need to be aware of to ensure they continue to operate effectively.

How Sysmon and Events Monitor work together

System Monitor (Sysmon) is a Windows service that writes activity to the Windows event log. The Insight Agent deploys the Sysmon service and uses it to collect the following events that InsightIDR and MDR are designed to analyze:

• Event ID 1: Process creation (referred to as Process Starts in Log Search)
• Event ID 8: CreateRemoteThread
• Event ID 25: ProcessTampering (Process image change)

After Sysmon writes these events to the Windows event log, the Events Monitor component is responsible for sending this data to the Insight Platform for InsightIDR and MDR to use. These events power Rapid7's Attacker Behavior Analytics (ABA) detections and are viewable in InsightIDR's Log Search feature under the Endpoint Activity log set.

ui_realtime - the alternative data collection component

The Insight Agent has its own alternative component called ui_realtime that is designed to take over events data collection responsibilities if any of the following scenarios are encountered during the Sysmon deployment phase:

• The operating system the Insight Agent is installed on is outdated or is not compatible with Sysmon.
• A pre-existing, non-Rapid7 deployment of Sysmon is already present on the asset (see the component overview for details).
• A system crash triggered the removal of the Rapid7-installed Sysmon service (see the known issues section for details).

The ui_realtime component runs in the user space of the operating system (as opposed to the kernel space where Sysmon runs), which makes it less efficient than Sysmon during times of heavy load. For this reason, ui_realtime is preferable serving a backup collection role.

The Sysmon service is preferred for its performance. The Insight Agent's implementation of Sysmon in concert with Events Monitor provides the best possible visibility on an asset running Windows.

Sysmon Installer - component overview

The Sysmon Installer component included with the Insight Agent is responsible for installing the Sysmon service on the asset on your behalf and assumes exclusive management of the service going forward. This includes the control of configuration, reinstallation, and uninstallation tasks. The Sysmon Installer component continuously monitors Sysmon to ensure the service is not modified by other third-party software, a user, or any other entity.

Configuration details

The Sysmon service is automatically configured by Sysmon Installer. This configuration is maintained and updated by Rapid7. Each event defined in the configuration file has been tuned to emphasize real-time monitoring over logging purposes. This configuration has been tested to ensure it does not have a material resource utilization impact on the asset itself.

Take care not to modify the Sysmon configuration in any way. At present, Sysmon configurations are unable to differentiate a potential attacker from a legitimate administrator. To promote the highest level of security, any modification of the Sysmon configuration will trigger corrective action.

How Sysmon Installer responds to modification attempts

If Sysmon Installer detects any modifications to the Sysmon service or its configuration, the component will take corrective action:

• If the Sysmon service is modified in any way (such as an upgrade or downgrade to a different version), Sysmon Installer will uninstall Sysmon and reinstall the version set by Rapid7.
• If the Sysmon configuration is modified in any way, Sysmon Installer will reload the configuration set by Rapid7.

These corrective measures are necessary to ensure that InsightIDR and MDR continue to receive the events data they rely on to power detections.

Known issues with the Sysmon service

Sysmon's nature as a kernel-level service gives it the ability to capture events early in the boot process. While desirable from a visibility perspective, this also increases the likelihood of Sysmon causing an overall system crash. As a best practice, Rapid7 mitigates the possibility of this happening by delaying Sysmon version upgrades for a time so that any unknown bugs can be addressed beforehand. As an exception to this, Rapid7 will update Sysmon to the latest version as soon as possible if the installed version is revealed to be vulnerable.

Sysmon Installer includes logic designed to safeguard asset stability. If an asset running a Rapid7-installed version of Sysmon experiences a system crash for any reason (whether attributed to Sysmon or not), Sysmon Installer will uninstall the Sysmon service automatically and promote ui_realtime as the sole component responsible for events data collection. From this point, Sysmon Installer would only reinstall Sysmon with the release of a new version.

How to request a custom Sysmon configuration

While it's possible to implement a custom Sysmon configuration outside of Rapid7's control, be aware that doing so will preclude your ability to use Sysmon to collect events data for use with InsightIDR and MDR. Events Monitor does not support the ingestion of events from any Sysmon deployment other than the one installed by Rapid7's Sysmon Installer. In this scenario, events data collection would once again be the responsibility of ui_realtime.

If you wish to proceed with a custom Sysmon configuration nonetheless, open a case with the Rapid7 Support team to get started. Rapid7 must first remove the Sysmon Installer component across your entire organization before you can implement your own Sysmon configuration.

Component resource utilization

This table provides an asset resource utilization breakdown for Events Monitor, the Sysmon service, and Sysmon Installer.