> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/05-sysmon-and-endpoint-visibility/observe-network-connections.md).

# Observe Network Connections

## Objective

Generate a simple network request from `CLIENT01` and find the related Sysmon Network Connect event.

Sysmon records supported network connection activity as Event ID `3` when that event type is enabled by the active configuration.

## Generate a DNS Request

On `CLIENT01`, open Command Prompt and run:

```
nslookup example.com
```

This creates a simple DNS request and gives us predictable network activity to inspect.

## Find the Event

Open the Sysmon Operational log and filter for:

```
3
```

Look for an event where the image ends with:

```
\nslookup.exe
```

## Review the Important Fields

Depending on the connection, you may see fields such as:

* UtcTime
* ProcessGuid
* ProcessId
* Image
* User
* Protocol
* SourceIp
* SourcePort
* DestinationIp
* DestinationHostname
* DestinationPort

Record the values that appear in your event.

## What Happened

The activity can be described simply:

1. `nslookup.exe` started.
2. The process contacted a DNS server.
3. Sysmon recorded the network connection.
4. The event linked the connection to the process that generated it.

## Investigation Questions

Use the event to answer:

1. Which process created the connection?
2. Which user was running the process?
3. What destination was contacted?
4. Which protocol and destination port were used?
5. Does the destination make sense for the process?

## Security Relevance

A network connection becomes more useful when it can be tied to a specific process and user.

For example, a browser connecting to the internet is expected. A process that normally should not communicate externally may require more attention.

## Verification

The lab is complete when you can find the `nslookup.exe` network event and explain which process made the connection and where it connected.