| sysmon-url | URL to Sysmon.zip. Defaults to Sysinternals latest. | no | https://download.sysinternals.com/files/Sysmon.zip |
| sysmon-sha256 | Expected SHA256 of the Sysmon.zip download. The action fails if the
download does not match. Set to an empty string to skip verification
(NOT recommended — Sysinternals serves "latest" from a single URL, so
the binary can change under you). Update this default per Sysmon release.
| no | REPLACE_WITH_PINNED_SHA256 |
| config-url | URL to a Sysmon config XML. Ignored if config-path is set. | no | https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml |
| config-sha256 | Expected SHA256 of the downloaded config XML. Empty to skip. Only
applies when downloading from config-url — has no effect on config-path.
| no | "" |
| config-path | Local path to a Sysmon config XML. Overrides config-url. | no | "" |
| artifact-name | Name for the uploaded logs artifact. | no | sysmon-logs |
| retention-days | Artifact retention in days. | no | 7 |
| upload | Whether the post step should collect and upload logs. | no | true |
| fail-on-suspicious | If true, fail the post step when suspicious events are detected. | no | false |
| abuseipdb-api-key | AbuseIPDB API key. When set, each distinct public IP observed is checked
against AbuseIPDB. Free tier: https://www.abuseipdb.com/register
Empty (default) disables the check. Pass a secret, never a literal.
| no | "" |
| abuseipdb-threshold | Flag an IP when its AbuseIPDB confidence-of-abuse score (0-100) is at or
above this value. Default 25.
| no | 25 |
| virustotal-api-key | VirusTotal API key. When set, each observed public IP and hostname is
checked against VirusTotal v3. Free tier: https://www.virustotal.com/gui/join-us
Empty (default) disables the check. Pass a secret, never a literal.
| no | "" |
| virustotal-threshold | Flag an IP/hostname when the number of VirusTotal engines reporting it
malicious is at or above this value. Default 1.
| no | 1 |
| reputation-max-lookups | Cap the number of IPs (and hostnames) sent to each reputation service, to
stay within free-tier rate limits. Default 40.
| no | 40 |
| fail-on-malicious | If true, fail the post step when any reputation check flags an IP or
hostname above its threshold.
| no | false |
| firewall-enabled | If true, download an IP blocklist at job start and load it into Windows
Defender Firewall as outbound block rules — a *preventive* egress control
(denies the connection inline, unlike the detective reputation checks).
Fails the job if the block cannot be applied (fail-closed). Default false.
| no | false |
| firewall-feed-url | Raw URL of the blocklist loaded when firewall-enabled is true. Defaults
to FireHOL level1 (curated, low false-positive, CIDR-aggregated). The list
is cached on the runner for the duration of the job. Sanity-check that your
chosen feed does not cover IPs your job legitimately needs. Set to an empty
string to block only firewall-block-ips.
| no | https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level1.netset |
| firewall-block-ips | Explicit IPs/CIDRs to block outbound, in addition to firewall-feed-url.
Comma- or newline-separated (e.g. '1.2.3.4, 5.6.7.0/24'). Applied only when
firewall-enabled is true.
| no | "" |
| suspicious-ids | Comma-separated Sysmon event IDs to flag as suspicious.
Defaults: 8 (CreateRemoteThread), 10 (ProcessAccess), 25 (ProcessTampering).
Common additions: 1 (ProcessCreate), 7 (ImageLoad), 11 (FileCreate),
13 (RegistryValueSet), 20 (WmiEventConsumer).
| no | 8,10,25 |