"Our SOC was ready for an endpoint detection and response solution, but we couldn't justify the spend before we clearly understood the value. We set out on a year-long journey to build our own solution around Sysinternals Sysmon. Using Sysmon, Windows Event Collection, SIEM, scripts, and a custom database app, we've created a solution that gets most of the value of a commercial solution at practically no cost. Our presentation is a case study for deploying Sysmon to thousands of endpoints, collecting the log data using native Windows features, and sending it to our SIEM in real-time. We'll detail our Sysmon and WEC infrastructure and config, while giving recommendations and pointing out pitfalls. We will share our favorite SIEM rules to detect evil on our endpoints, and how we present the data back to our analysts for effective investigations. Finally, we'll show how we're enriching the logs with third-party threat intel, and hunting with the data using more advanced analytics."