Did you know that there's an alternative to Sysmon? A product that comes with Sysmon and Sigma rule converters, excels with a graphical rule editor and uses a simple yet powerful query language instead of XML. Oh, and it offers sophisticated application monitoring for all Windows and macOS endpoints, including Citrix, too

This product is uberAgent ESA. It's developed in Germany by vast limits, whose founder, Helge Klein, presents its capabilities in this session.