> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/05-sysmon-and-endpoint-visibility/basic-endpoint-investigation.md).

# Perform a Basic Endpoint Investigation

## Objective

Generate a short sequence of normal activity on `CLIENT01` and use Sysmon to reconstruct what happened.

This lab combines the event types introduced earlier instead of looking at each event in isolation.

## Generate the Activity

On `CLIENT01`:

1. Open **Command Prompt**.
2. Run:

```
notepad.exe C:\ZyberLab\investigation-note.txt
```

3. Type:

```
ZyberLab investigation test
```

4. Save the file and close Notepad.
5. Return to Command Prompt and run:

```
nslookup example.com
```

You have now generated process activity, file activity, and network activity.

## Investigation Goal

Use the Sysmon Operational log to reconstruct the sequence.

Look for:

* Event ID `1` for process creation
* Event ID `11` for the file creation
* Event ID `3` for the network connection

## Build a Simple Timeline

Create a small table in your lab notes:

| Time        | Event ID | Process      | Activity           |
| ----------- | -------- | ------------ | ------------------ |
| Record time | 1        | notepad.exe  | Process started    |
| Record time | 11       | notepad.exe  | File created       |
| Record time | 1        | nslookup.exe | Process started    |
| Record time | 3        | nslookup.exe | Network connection |

Your exact event order may contain additional Windows activity. Focus only on the events related to the actions you deliberately performed.

## Questions to Answer

Try to answer these questions without relying on memory of the steps:

1. Which user performed the activity?
2. Which process created `investigation-note.txt`?
3. Which process launched Notepad?
4. Which process performed the DNS request?
5. What destination was contacted?
6. At what time did each action occur?
7. Does the sequence make sense as one normal user workflow?

## What You Are Practicing

The important skill is not memorizing Event IDs.

You are practicing how to move from individual records to a simple explanation:

```
A user opened Command Prompt.
The user launched Notepad.
Notepad created a text file in the lab folder.
The user then ran nslookup.
Nslookup contacted a DNS server.
```

That explanation is the beginning of an endpoint investigation timeline.

## Security Relevance

Security tools can generate large volumes of telemetry. An analyst needs to identify the events that belong together, place them in time order, and explain what the endpoint actually did.

This same approach can later be applied to suspicious scripts, unusual processes, unexpected network connections, and security alerts.

## Clean Up

Delete the test file when the exercise is complete:

```
C:\ZyberLab\investigation-note.txt
```

No other cleanup should be required.

## Verification

The lab is complete when you can reconstruct the activity using Sysmon events without depending only on the steps you remember performing.