n0rthl1ght

Solved problem with hook. My apologies for this. Can you add option for sending the first report in continuous run to slack or email?

> here my sysmon base rules: > > https://github.com/n00bsteam/SigmaWazuhRules/blob/main/sysmon_groups.xml Dude, do you have hash on filecreation? 11id