From 102a2442377905cf4b2007bd437530735b006ff2 Mon Sep 17 00:00:00 2001
From: Jarrod-L <48501608+Jarrod-L@users.noreply.github.com>
Date: Mon, 10 Feb 2020 11:21:40 -0600
Subject: [PATCH] clarify wording in what-is-sysmon.md

Modify wording of 3rd paragraph to make it a little easier to read and understand.
---
 what-is-sysmon.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/what-is-sysmon.md b/what-is-sysmon.md
index 06e9fd1..d77a85d 100644
--- a/what-is-sysmon.md
+++ b/what-is-sysmon.md
@@ -3,7 +3,7 @@ What is Sysmon
 
 Sysmon is a free tool initially developed by Mark Russinovich and has contributions by Tomas Garnier, David Magnotti, Mark Cook, Rob Mead, Giulia Biagini, and others at Microsoft. The tool is designed to extend the current logging capabilities in Windows to aid in understanding and detecting attackers by behavior. It was developed originally for internal use at Microsoft. (Note: There are still two versions of the tool—internal and external.) Currently, the tool supports 64-bit and 32-bit systems and uses a single command line tool for installation and configuration management.
 
-For ease of collecting the logs, all of the events generated are saved in Microsoft-Windows-Sysmon/Operational EventLog, which allows current security products that already leverage collection from the EventLog in Windows.
+All of the events generated by Sysmon are saved in Microsoft-Windows-Sysmon/Operational EventLog in order to accomodate security products that already leverage the EventLog, and to make the events easier to view and collect.
 
 Sysmon is able to monitor for a series of actions on a Windows host that relate to existing behavior that is abused by threat actors. With this view on the actions, defenders are able to better detect abnormal behavior and abuses on a system.