> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/05-sysmon-and-endpoint-visibility/explore-sysmon-log.md).

# Explore the Sysmon Operational Log

## Objective

Locate the Sysmon event log on `CLIENT01` and become familiar with the information shown in a Sysmon event.

## Open Event Viewer

On `CLIENT01`:

1. Open **Event Viewer**.
2. Expand **Applications and Services Logs**.
3. Expand **Microsoft**.
4. Expand **Windows**.
5. Open **Sysmon**.
6. Select **Operational**.

The full path is:

```
Applications and Services Logs
Microsoft
Windows
Sysmon
Operational
```

## Review the Log

You should see events generated after Sysmon was installed.

Select a few events and review both the **General** and **Details** tabs.

Do not worry about understanding every field yet.

## Useful Fields to Notice

Depending on the event type, Sysmon may include information such as:

* event time
* process image
* process ID
* process GUID
* parent process
* user
* command line
* source and destination addresses
* destination port
* target file name
* hashes

## Filter the Log

Right click **Operational** and select **Filter Current Log**.

Enter an Event ID such as:

```
1
```

This limits the view to Process Create events.

Clear the filter when you finish.

## Why Process GUID Matters

Windows process IDs are reused over time. Sysmon also records a Process GUID, which provides a more reliable way to relate activity to a specific process instance.

You do not need to memorize the GUID. Just understand why it can be useful when correlating multiple events.

## Verification

The lab is complete when you can:

* open the Sysmon Operational log
* filter by an Event ID
* find the process image in an event
* locate the user and command line when present
* identify the Process GUID field

## Security Relevance

Endpoint investigations often require several related pieces of information rather than one isolated event. Learning where Sysmon stores its data and how to read common fields is the foundation for the next exercises.