<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Sysmon Configuration

## sysmon64.exe

### Commands

| Command | Description |
|---|---|
| `sysmon64.exe -accepteula -i config.xml` | Install Sysmon with configuration |
| `sysmon64.exe -c config.xml` | Update running configuration |
| `sysmon64.exe -c` | Print current configuration |
| `sysmon64.exe -u [force]` | Uninstall Sysmon |
| `sysmon64.exe -s` | Print configuration schema |

### Event IDs

| EID | Tag Name | Description |
|---|---|---|
| 1 | `ProcessCreate` | Process creation with full command line |
| 2 | `FileCreateTime` | File creation time changed |
| 3 | `NetworkConnect` | Network connection detected |
| 5 | `ProcessTerminate` | Process terminated |
| 7 | `ImageLoad` | DLL/image loaded |
| 8 | `CreateRemoteThread` | Remote thread creation |
| 10 | `ProcessAccess` | Process accessed (e.g., LSASS) |
| 11 | `FileCreate` | File created |
| 12 | `RegistryEvent` | Registry object added/deleted |
| 13 | `RegistryEvent` | Registry value set |
| 15 | `FileCreateStreamHash` | Alternate data stream created |
| 17 | `PipeEvent` | Named pipe created |
| 22 | `DnsQuery` | DNS query performed |
| 23 | `FileDelete` | File deleted (archived) |
| 25 | `ProcessTampering` | Process image change detected |

### XML Filter Conditions

| Condition | Behavior |
|---|---|
| `is` | Exact string match |
| `is not` | Negated exact match |
| `contains` | Substring match |
| `excludes` | Negated substring match |
| `begin with` | Prefix match |
| `end with` | Suffix match |
| `image` | Match image path (filename only) |

### Agent Script

```bash
# Validate config XML
node agent.js validate sysmon-config.xml

# Audit coverage gaps
node agent.js audit sysmon-config.xml

# Measure event volume
node agent.js measure-volume

# Generate config skeleton
node agent.js generate --profile balanced
```
