{"id":901,"date":"2026-10-20T23:13:31","date_gmt":"2026-10-20T23:13:31","guid":{"rendered":"https:\/\/windows-vps.org\/blog\/?p=901"},"modified":"2026-10-20T23:13:31","modified_gmt":"2026-10-20T23:13:31","slug":"sysmon-deployment-windows-server-tuning","status":"publish","type":"post","link":"https:\/\/windows-vps.org\/blog\/sysmon-deployment-windows-server-tuning\/","title":{"rendered":"Deploying Sysmon on Windows Server: Filtering, Event Volume, and Detection Queries"},"content":{"rendered":"<div style=\"padding:20px\">\n<p>Sysmon extends the Windows event log with process creation, network connection, file creation, and registry events that carry hashes, parent process lineage, and full command lines \u2014 the telemetry that native auditing omits. Deploying it on a Windows Server is straightforward; tuning it so it produces an analysable volume on a small VPS is the actual work. This guide goes from install to a working configuration with measured event rates, plus the specific detections worth keeping when you have limited disk. The approach assumes you already have operational logging discipline in place for the <a href=\"https:\/\/windows-vps.org\/\">Windows Server infrastructure<\/a> you are monitoring.<\/p>\n<h2>Why Sysmon and Not Just Audit Policy<\/h2>\n<ul>\n<li>Native <code>4688<\/code> process creation requires <code>Audit Process Creation<\/code> plus the <code>ProcessCreationIncludeCmdLine_Enabled<\/code> registry value, and still lacks hashes and parent image paths.<\/li>\n<li>Sysmon event 1 includes <code>Image<\/code>, <code>CommandLine<\/code>, <code>User<\/code>, <code>ParentImage<\/code>, <code>ParentCommandLine<\/code>, and optionally <code>Hashes<\/code>.<\/li>\n<li>Sysmon event 3 records outbound connections with process and destination \u2014 the cheapest signal for drive-by downloaders and C2 beacons.<\/li>\n<li>Events are written to <code>Microsoft-Windows-Sysmon\/Operational<\/code>, a separate channel with its own size limit, so you can size it without disturbing Security log retention.<\/li>\n<\/ul>\n<h2>Install and Verify<\/h2>\n<pre><code># Download to a fixed path, verify the signature, install with a config\n$url = 'https:\/\/download.sysinternals.com\/files\/Sysmon.zip'\nInvoke-WebRequest $url -OutFile C:\\Tools\\Sysmon.zip\nExpand-Archive C:\\Tools\\Sysmon.zip C:\\Tools\\Sysmon -Force\nGet-AuthenticodeSignature C:\\Tools\\Sysmon\\Sysmon64.exe | Select Status, SignerCertificate\n\nC:\\Tools\\Sysmon\\Sysmon64.exe -accepteula -i C:\\Tools\\Sysmon\\sysmon-config.xml\n\n# Verify service and driver\nGet-Service Sysmon64\nfltmc filters | Select-String Sysmon\nGet-WinEvent -LogName 'Microsoft-Windows-Sysmon\/Operational' -MaxEvents 5 |\n    Select-Object TimeCreated, Id, Message\n<\/code><\/pre>\n<p>Three failure modes to expect:<\/p>\n<ul>\n<li><strong>Signed driver rejected<\/strong> \u2014 on Secure Boot systems with HVCI, an old Sysmon build may fail to load. Use the current release; Sysmon 15.x ships a WHQL-signed driver.<\/li>\n<li><strong>Config parse error<\/strong> \u2014 <code>-c<\/code> reports the hash mismatch or schema problem on stderr and the service does not start. Validate XML with <code>[xml](Get-Content config.xml)<\/code> first.<\/li>\n<li><strong>Events stop after a reboot<\/strong> \u2014 the service is set to Manual by the installer in some builds; set it to Automatic and add a delayed start.<\/li>\n<\/ul>\n<h2>A Configuration That Survives on 4 vCPU \/ 8 GB<\/h2>\n<p>The SwiftOnSecurity and Olaf Hartong configurations are excellent baselines, but both are tuned for fleets with central collection. On a single VPS, start restrictive and add.<\/p>\n<pre><code>&lt;Sysmon schemaversion=\"4.90\"&gt;\n  &lt;EventFiltering&gt;\n    &lt;ProcessCreate onmatch=\"include\"&gt;\n      &lt;Image condition=\"end with\"&gt;cmd.exe&lt;\/Image&gt;\n      &lt;Image condition=\"end with\"&gt;powershell.exe&lt;\/Image&gt;\n      &lt;Image condition=\"end with\"&gt;wscript.exe&lt;\/Image&gt;\n      &lt;Image condition=\"end with\"&gt;cscript.exe&lt;\/Image&gt;\n      &lt;Image condition=\"end with\"&gt;mshta.exe&lt;\/Image&gt;\n      &lt;Image condition=\"end with\"&gt;rundll32.exe&lt;\/Image&gt;\n      &lt;Image condition=\"end with\"&gt;regsvr32.exe&lt;\/Image&gt;\n      &lt;Image condition=\"end with\"&gt;certutil.exe&lt;\/Image&gt;\n      &lt;ParentImage condition=\"end with\"&gt;w3wp.exe&lt;\/ParentImage&gt;\n      &lt;User condition=\"is\"&gt;NT AUTHORITY\\SYSTEM&lt;\/User&gt;\n    &lt;\/ProcessCreate&gt;\n    &lt;NetworkConnect onmatch=\"exclude\"&gt;\n      &lt;DestinationPort condition=\"is\"&gt;443&lt;\/DestinationPort&gt;\n    &lt;\/NetworkConnect&gt;\n    &lt;FileCreate onmatch=\"include\"&gt;\n      &lt;TargetFilename condition=\"contains\"&gt;\\Startup\\&lt;\/TargetFilename&gt;\n      &lt;TargetFilename condition=\"contains\"&gt;\\Tasks\\&lt;\/TargetFilename&gt;\n    &lt;\/FileCreate&gt;\n    &lt;RegistryEvent onmatch=\"include\"&gt;\n      &lt;TargetObject condition=\"contains\"&gt;CurrentVersion\\Run&lt;\/TargetObject&gt;\n    &lt;\/RegistryEvent&gt;\n  &lt;\/EventFiltering&gt;\n&lt;\/Sysmon&gt;\n<\/code><\/pre>\n<p>Update the running configuration without a service restart:<\/p>\n<pre><code>C:\\Tools\\Sysmon\\Sysmon64.exe -c C:\\Tools\\Sysmon\\sysmon-config.xml\nGet-WinEvent -LogName 'Microsoft-Windows-Sysmon\/Operational' -MaxEvents 300 |\n    Group-Object Id | Sort-Object Count -Descending |\n    Select-Object Name, Count\n<\/code><\/pre>\n<p>Measure events per hour rather than looking at totals. On an idle server, the configuration above produces under 200 events\/hour; with IIS traffic and SQL, expect 1,000\u20133,000. If you see more than 10,000\/hour, find the dominant event ID and add a targeted exclude rather than narrowing the include list \u2014 over-narrowing is how detections get silently disabled.<\/p>\n<h2>Log Channel Sizing and Rotation<\/h2>\n<table>\n<thead>\n<tr>\n<th>Metric<\/th>\n<th>Idle VPS<\/th>\n<th>Busy web + SQL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Events per hour (filtered)<\/td>\n<td>~150<\/td>\n<td>1,000\u20133,000<\/td>\n<\/tr>\n<tr>\n<td>Bytes per event (avg)<\/td>\n<td>~700 B<\/td>\n<td>~900 B<\/td>\n<\/tr>\n<tr>\n<td>Recommended channel max<\/td>\n<td>256 MB<\/td>\n<td>1\u20132 GB<\/td>\n<\/tr>\n<tr>\n<td>Retention with 1 GB at 2,000 ev\/h<\/td>\n<td>\u2014<\/td>\n<td>~3\u20134 days<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<pre><code>wevtutil sl \"Microsoft-Windows-Sysmon\/Operational\" \/ms:1073741824 \/rt:false\nGet-WinEvent -ListLog 'Microsoft-Windows-Sysmon\/Operational' |\n    Select-Object LogName, MaximumSizeInBytes, RecordCount, FileSize\n<\/code><\/pre>\n<p><code>\/rt:false<\/code> is essential: with auto-overwrite on, events roll off silently and you may lose the window you care about. Better still, forward the channel with Windows Event Forwarding to a collector or push with <code>fluent-bit<\/code>\/<code>winlogbeat<\/code> to a remote store, then keep local retention short.<\/p>\n<h2>Detections Worth Building First<\/h2>\n<ul>\n<li><strong>Office\/script host spawning a shell<\/strong> \u2014 Sysmon 1 where <code>ParentImage<\/code> ends in <code>w3wp.exe<\/code> and <code>Image<\/code> ends in <code>cmd.exe<\/code>. On an IIS server this is almost always a webshell.<\/li>\n<li><strong>Base64-encoded PowerShell<\/strong> \u2014 Sysmon 1 regex on <code>-enc<\/code>\/<code>-EncodedCommand<\/code>, plus the existing script block log (4104) for the decoded text.<\/li>\n<li><strong>Service binary written to temp<\/strong> \u2014 Sysmon 11 where <code>TargetFilename<\/code> is under <code>%TEMP%<\/code> and ends in <code>.exe<\/code> with a signature status of Unsigned.<\/li>\n<li><strong>New outbound to uncommon port<\/strong> \u2014 Sysmon 3 to ports other than 80\/443\/53, with the process name attached.<\/li>\n<li><strong>Hidden scheduled task<\/strong> \u2014 Sysmon 1\/11 combined with <code>schtasks.exe \/create<\/code> and a target under <code>\\Tasks\\<\/code> whose XML is deleted immediately after.<\/li>\n<\/ul>\n<h2>Tuning the Parser Cache and Kernel Objects<\/h2>\n<p>Sysmon keeps an internal cache of image metadata so it does not re-parse the same binary on every process start. On a server running IIS with dozens of application pool recycles an hour, the default cache is under-sized and you will see repeated <code>FileCreate<\/code> and hash computation for the same DLLs.<\/p>\n<pre><code>&lt;Sysmon schemaversion=\"4.90\"&gt;\n  &lt;HashAlgorithms&gt;SHA256&lt;\/HashAlgorithms&gt;\n  &lt;CheckRevocation&gt;false&lt;\/CheckRevocation&gt;\n  &lt;DnsLookup&gt;false&lt;\/DnsLookup&gt;\n  &lt;ArchiveDirectory&gt;Sysmon\\Archive&lt;\/ArchiveDirectory&gt;\n&lt;\/Sysmon&gt;\n<\/code><\/pre>\n<ul>\n<li><code>CheckRevocation=false<\/code> \u2014 revocation checking adds a network round trip per new binary and can stall signature checks when the CA&#8217;s CRL host is slow. Keep it false on servers.<\/li>\n<li><code>DnsLookup=false<\/code> \u2014 reverse lookups on event 3 add latency to the network event path. Resolve destination addresses later, centrally.<\/li>\n<li><code>SHA256<\/code> only \u2014 hashing every binary with all four algorithms quadruples the CPU cost of first-run events for no diagnostic gain.<\/li>\n<li><code>ArchiveDirectory<\/code> \u2014 keeps a copy of binaries written to disk before they are deleted; useful for malicious-download forensics, but budget disk for it and exclude IIS temp directories.<\/li>\n<\/ul>\n<p>Size the Sysmon driver&#8217;s memory use indirectly by watching private bytes of <code>Sysmon64<\/code> after a week of uptime. A steady climb from 40 MB to 300 MB indicates a configuration generating large numbers of events into a queue the consumer cannot drain \u2014 either the channel write is slow or a collector is back-pressuring.<\/p>\n<h2>Correlating Sysmon With the Rest of the Log<\/h2>\n<p>Sysmon is most valuable when joined to other channels by a key. The keys that work in practice:<\/p>\n<ul>\n<li><code>ProcessGuid<\/code> \u2014 Sysmon&#8217;s own process identifier, stable across the life of the process. Events 1, 3, 11, 12, and 8 all carry it, so a single GUID reconstructs a process tree and its side effects.<\/li>\n<li><code>ProcessId<\/code> + <code>UtcTime<\/code> \u2014 joins to Security 4688 and 4624 when you need the logon session that started the process.<\/li>\n<li><code>Hashes<\/code> \u2014 joins to Defender detections (event 1116\/1117) and to IOC feeds.<\/li>\n<\/ul>\n<p>With a PowerShell pipeline you can reconstruct a single child process tree without any SIEM:<\/p>\n<pre><code>$since = (Get-Date).AddMinutes(-30)\n$ev = Get-WinEvent -FilterHashtable @{\n    LogName='Microsoft-Windows-Sysmon\/Operational'; Id=1; StartTime=$since\n}\n$ev | ForEach-Object {\n    $x = [xml]$_.ToXml()\n    [pscustomobject]@{\n        Time = $x.Event.System.TimeCreated.SystemTime\n        Parent = ($x.Event.EventData.Data | Where ParentImage).'#text'\n        Image  = ($x.Event.EventData.Data | Where Image).'#text'\n        Cmd    = ($x.Event.EventData.Data | Where CommandLine).'#text'\n        User   = ($x.Event.EventData.Data | Where User).'#text'\n    }\n} | Where-Object Parent -like '*w3wp.exe*' | Format-Table -AutoSize -Wrap\n<\/code><\/pre>\n<p>That one query answers the webshell question directly: did the IIS worker spawn a shell, and as which identity. Keep it in a script on the server so it works when the SIEM is unavailable.<\/p>\n<h2>Keeping It Running<\/h2>\n<ol>\n<li>Pin the Sysmon binary version. An unannounced upgrade has changed default filtering in the past.<\/li>\n<li>Store the config in source control and deploy it to every server with <code>-c<\/code>, so diffs are reviewable.<\/li>\n<li>Alert on the service stopping: <code>Get-Service Sysmon64<\/code> in a 5-minute scheduled task that writes to the Application log.<\/li>\n<li>Review unknown-generating events monthly; each exclusion added should be justified with the process and why it is benign.<\/li>\n<li>Watch disk: Sysmon&#8217;s event file grows in the same way the Security log does, and a full system drive breaks IIS and SQL before it breaks Sysmon.<\/li>\n<\/ol>\n<p>Sysmon is high-value telemetry with a bounded cost, provided you size the channel and filter before you enable it on a production box. Treat the configuration as code and the event volume as a capacity metric, and it becomes one of the more reliable detection layers available on a single <a href=\"https:\/\/windows-vps.org\/\">Windows Server host<\/a> without a full EDR subscription.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Sysmon extends the Windows event log with process creation, network connection, file creation, and registry events that carry hashes, parent process lineage, and full command lines \u2014 the telemetry that native auditing omits. Deploying it on a Windows Server is straightforward; tuning it so it produces an analysable volume on a small VPS is the &#8230; <a title=\"Deploying Sysmon on Windows Server: Filtering, Event Volume, and Detection Queries\" class=\"read-more\" href=\"https:\/\/windows-vps.org\/blog\/sysmon-deployment-windows-server-tuning\/\" aria-label=\"Read more about Deploying Sysmon on Windows Server: Filtering, Event Volume, and Detection Queries\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":0,"footnotes":""},"categories":[5],"tags":[],"class_list":["post-901","post","type-post","status-publish","format-standard","hentry","category-tutorials-guides"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Deploying Sysmon on Windows Server: Filtering, Event Volume, and Detection Queries - Windows VPS Blog<\/title>\n<meta name=\"description\" content=\"Sysmon extends the Windows event log with process creation, network connection, file creation, and registry events that carry hashes, parent process\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/windows-vps.org\/blog\/sysmon-deployment-windows-server-tuning\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Deploying Sysmon on Windows Server: Filtering, Event Volume, and Detection Queries\" \/>\n<meta property=\"og:description\" content=\"Deploying Sysmon on Windows Server: Filtering, Event Volume, and Detection Queries\" \/>\n<meta property=\"og:url\" content=\"https:\/\/windows-vps.org\/blog\/sysmon-deployment-windows-server-tuning\/\" \/>\n<meta property=\"og:site_name\" content=\"Windows VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-20T23:13:31+00:00\" \/>\n<meta name=\"author\" content=\"windows-vps\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@myxiechengxuan\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"windows-vps\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/windows-vps.org\/blog\/sysmon-deployment-windows-server-tuning\/\",\"url\":\"https:\/\/windows-vps.org\/blog\/sysmon-deployment-windows-server-tuning\/\",\"name\":\"Deploying Sysmon on Windows Server: Filtering, Event Volume, and Detection Queries - Windows VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\"},\"datePublished\":\"2026-10-20T23:13:31+00:00\",\"author\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\"},\"description\":\"Sysmon extends the Windows event log with process creation, network connection, file creation, and registry events that carry hashes, parent process\",\"breadcrumb\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/sysmon-deployment-windows-server-tuning\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/windows-vps.org\/blog\/sysmon-deployment-windows-server-tuning\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/windows-vps.org\/blog\/sysmon-deployment-windows-server-tuning\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/windows-vps.org\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Deploying Sysmon on Windows Server: Filtering, Event Volume, and Detection Queries\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\",\"url\":\"https:\/\/windows-vps.org\/blog\/\",\"name\":\"Windows VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/windows-vps.org\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\",\"name\":\"windows-vps\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"caption\":\"windows-vps\"},\"sameAs\":[\"https:\/\/windows-vps.org\/blog\",\"https:\/\/x.com\/myxiechengxuan\"],\"url\":\"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Deploying Sysmon on Windows Server: Filtering, Event Volume, and Detection Queries - Windows VPS Blog","description":"Sysmon extends the Windows event log with process creation, network connection, file creation, and registry events that carry hashes, parent process","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/windows-vps.org\/blog\/sysmon-deployment-windows-server-tuning\/","og_locale":"en_US","og_type":"article","og_title":"Deploying Sysmon on Windows Server: Filtering, Event Volume, and Detection Queries","og_description":"Deploying Sysmon on Windows Server: Filtering, Event Volume, and Detection Queries","og_url":"https:\/\/windows-vps.org\/blog\/sysmon-deployment-windows-server-tuning\/","og_site_name":"Windows VPS Blog","article_published_time":"2026-10-20T23:13:31+00:00","author":"windows-vps","twitter_card":"summary_large_image","twitter_creator":"@myxiechengxuan","twitter_misc":{"Written by":"windows-vps","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/windows-vps.org\/blog\/sysmon-deployment-windows-server-tuning\/","url":"https:\/\/windows-vps.org\/blog\/sysmon-deployment-windows-server-tuning\/","name":"Deploying Sysmon on Windows Server: Filtering, Event Volume, and Detection Queries - Windows VPS Blog","isPartOf":{"@id":"https:\/\/windows-vps.org\/blog\/#website"},"datePublished":"2026-10-20T23:13:31+00:00","author":{"@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58"},"description":"Sysmon extends the Windows event log with process creation, network connection, file creation, and registry events that carry hashes, parent process","breadcrumb":{"@id":"https:\/\/windows-vps.org\/blog\/sysmon-deployment-windows-server-tuning\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/windows-vps.org\/blog\/sysmon-deployment-windows-server-tuning\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/windows-vps.org\/blog\/sysmon-deployment-windows-server-tuning\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/windows-vps.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Deploying Sysmon on Windows Server: Filtering, Event Volume, and Detection Queries"}]},{"@type":"WebSite","@id":"https:\/\/windows-vps.org\/blog\/#website","url":"https:\/\/windows-vps.org\/blog\/","name":"Windows VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/windows-vps.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58","name":"windows-vps","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","caption":"windows-vps"},"sameAs":["https:\/\/windows-vps.org\/blog","https:\/\/x.com\/myxiechengxuan"],"url":"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/"}]}},"_links":{"self":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/901","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/comments?post=901"}],"version-history":[{"count":1,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/901\/revisions"}],"predecessor-version":[{"id":903,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/901\/revisions\/903"}],"wp:attachment":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/media?parent=901"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/categories?post=901"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/tags?post=901"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}