LME 2.0 - Sysmon dashboard

[abrightman88]

Hi,

I've setup LME 2.0 and all seems good although there are no events showing under Sysmon Summary 2.0. Am I missing something? Any advise would be great

Thanks

[mreeve-snl]

https://github.com/cisagov/LME/blob/main/docs/markdown/reference/dashboard-descriptions.md#prerequisites
we should probably make this easier to find, hopefully the pre-reqs is helpful for everything you need to setup prior to getting the sysmon dashboards to populate.

if you've setup all the agents + sysmon service running on windows you usually need to wait for logs to start populating in elasticsearch.

If making sure all that is working... you could also try following some of the elastic agent debugging steps we've highlighted here:
https://github.com/cisagov/LME/blob/main/docs/markdown/agents/elastic-agent-mangement.md#troubleshooting-agent-setup