Resource Access Monitor logging

[Syntch]

Is there a way to have the Resource Access Monitor always running in the background and logging to a file or other service? If not Resource Access Monitor, perhaps some other tool?

[Barb@Invincea]

Hello Syntch,

The Resource Access Monitor appears in front of Sandboxie Control. Once you are done using it, you can click on "Copy Contents ..." and paste them in a file.
You can also invoke it and then use the Taskbar Icon ("pizza" icon) in order to launch applications from your Sandboxes while the monitor is running.

Here's some more information regarding how Resource Access Monitor works:
https://www.sandboxie.com/index.php?Res ... essMonitor

Another tool that you can use (and run in the background, add filters, export logs, etc...) is procmon
---> https://technet.microsoft.com/en-us/sys ... nitor.aspx

Regards,
Barb.-

[Syntch]

Thanks for the reply.

I am looking for a way to centrally log the actions within sandboxes on multiple systems. This would be used as input to something like a security information and event manager (SIEM) and/or used after a security incident by forensics. The output from the the Resource Access Monitor looks like the information I want, but it would need to be logged to a file or service automatically (which doesn't seem mentioned as possible in the link you provided?).

Is it possible to configure procmon so that it only logs all changes made by a sandbox (or all sandboxes on a system)?

[Barb@Invincea]

Syntch,

Perhaps this will help:
http://www.howtogeek.com/school/sysinte ... sson4/all/

Regards,
Barb.-

[Curt@invincea]

Thanks for the reply.

I am looking for a way to centrally log the actions within sandboxes on multiple systems. This would be used as input to something like a security information and event manager (SIEM) and/or used after a security incident by forensics. The output from the the Resource Access Monitor looks like the information I want, but it would need to be logged to a file or service automatically (which doesn't seem mentioned as possible in the link you provided?).

Is it possible to configure procmon so that it only logs all changes made by a sandbox (or all sandboxes on a system)?

This sounds like a job for Invincea X https://www.invincea.com/