Sysmon uses the Internet to reach your network. I can monitor my own servers locally. Most importantly, Sysmon tells you if your services are really available to your customers because we check their responsiveness via your Internet connection. You will always know with certainty that mail is deliverable, that your DNS server is resolving or that your web site is returning requests. But even for those that don't, security risks are minimal.
Monitoring is done from a secure network.
By knowing the IP addresses of Sysmon's monitoring servers, it is possible to configure your firewalls and routers to allow Sysmon to monitor your Intranet servers without leaving them exposed to the security risks of the general Internet. We speak the protocol of the monitored service and issue commands designed to test that the service is working properly. Note that if the first test fails we perform a second test. If the second test succeeds we record a warning. Otherwise, we record an error and generate an alert.