Sources (Settings › Sources)¶
FreeDR collects most of its telemetry itself, through kernel ETW, the NTFS change journal and the artifact inventory. Some detections also need Windows features that are off by default, or Sysmon. Settings › Sources shows each of these optional sources and its live status. You can turn a source on or off with one click.
Nothing changes unless you click. Every change is read back from Windows, recorded, and can be undone with Restore.
Status colours¶
| Colour | Meaning |
|---|---|
| Green | Enabled and producing events in the last 24 hours. For sources FreeDR does not collect itself, the setting is enabled. |
| Amber | Enabled, but no events in the last 24 hours, the Event Log collector is not running, or FreeDR's subscription to the channel is closed and retrying |
| Red | Disabled, or not available (for example, the channel is not registered on this host) |
| Grey | Not applicable on this Windows edition (for example, AppLocker on Home) |
Whether a source is producing comes from the Event Log collector's in-memory record of the last time it saw each channel and event ID. Status is refreshed at most every 10 seconds. Use Refresh to reload.
Actions¶
| Action | Effect |
|---|---|
| Enable | Writes the value that turns the source on. If the source depends on another setting, that setting is turned on first, as its own recorded change. |
| Disable | Turns the source off. For audit policies, only the bits FreeDR needs are cleared. |
| Restore | Writes back the value the setting had before FreeDR first changed it (since the last restore). For a registry value that did not exist before, the value is deleted. |
| Install | Sysmon only: runs FreeDR's Sysmon installer (5-minute limit). |
Turning a source off from the console raises an alert, FreeDR telemetry
source weakened from the console
(freedr.self.telemetry-source-weakened). It appears in alerts, cases, the
tray and notifications like any other alert.
Changes made here lists every change: who made it, when, which setting, and the value before and after.
Source list¶
Sysmon¶
| Source | Notes |
|---|---|
| Sysmon | Process, network, DNS, file, registry, WMI and pipe events used by many rules. Shows the service name (Sysmon64 or Sysmon) and the configuration hash Sysmon recorded. Install appears only when Sysmon is missing. FreeDR installs Sysmon with its own configuration and never reconfigures or removes an existing installation. Installing needs internet access to Microsoft's download site. |
PowerShell¶
| Source | Windows setting | Events |
|---|---|---|
| PowerShell script block logging | HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\EnableScriptBlockLogging = 1 |
PowerShell/Operational 4104 (script text, including decoded commands) |
Audit policy¶
| Source | Events | Notes |
|---|---|---|
| Audit Process Creation | Security 4688 | Needs Include command line in process creation events. Enable turns that on first. FreeDR does not collect 4688; it reads process starts from kernel ETW. |
| Include command line in process creation events | — | HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled = 1 |
| Audit Security Group Management | Security 4728, 4732, 4756 | Members added to privileged groups |
| Audit Other Object Access Events | Security 4698–4702 | Scheduled tasks created, changed, enabled, disabled or deleted |
| Audit MPSSVC Rule-Level Policy Change | Security 4946–4948 | Windows Firewall rules added, changed or deleted |
| Audit Logon | Security 4624, 4625, 4648 | Success and failure |
| Audit Special Logon | Security 4672 | Logons with administrative privileges |
| Audit Audit Policy Change | Security 4719 | Someone changed the audit policy |
Event channels¶
| Source | Channel | Purpose |
|---|---|---|
| Windows Firewall event channel | Microsoft-Windows-Windows Firewall With Advanced Security/Firewall |
Firewall 2004/2005/2006/2097: rules added, changed or deleted |
| TaskScheduler/Operational | Microsoft-Windows-TaskScheduler/Operational |
Task registration, update, deletion and runs |
| CodeIntegrity/Operational | Microsoft-Windows-CodeIntegrity/Operational |
Images that failed signing-level or code integrity checks |
| AppLocker EXE and DLL | Microsoft-Windows-AppLocker/EXE and DLL |
Audited and blocked executables. Not available on Home (grey). |
| Kernel-PnP/Configuration | Microsoft-Windows-Kernel-PnP/Configuration |
Devices configured and started, such as USB storage |
| VHDMP/Operational | Microsoft-Windows-VHDMP-Operational |
Virtual disks (ISO, VHD) mounted |
Microsoft Defender (read-only)¶
| Source | Shows |
|---|---|
| Defender/Operational | Whether the channel is enabled and producing events (detections, actions, configuration and tamper events) |
| Defender real-time protection | On / Off / not reported (Defender off, or another antivirus is active) |
| Defender Tamper Protection | On / Off / not reported |
FreeDR only reports Defender settings. Change them in Windows Security.
Before uninstalling¶
Changes made on this page stay in place after FreeDR is removed. To return Windows to its earlier settings, use Restore on each changed source before uninstalling.