> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/05-sysmon-and-endpoint-visibility/sysmon-checkpoint.md).

# Sysmon and Endpoint Visibility Checkpoint

This checkpoint confirms that the first Sysmon learning stage is complete and that `CLIENT01` is ready for later endpoint monitoring exercises.

## Check the Installation

Confirm that:

* Sysmon is installed on `CLIENT01`
* the Sysmon service is running
* the lab configuration is loaded
* Windows Defender remains enabled
* the Sysmon Operational log is available

## Check Event Visibility

Confirm that you can locate the following event types when you deliberately generate the related activity:

| Event ID | Activity                            |
| -------- | ----------------------------------- |
| 1        | Process creation                    |
| 3        | Selected network connections        |
| 11       | File creation inside the lab folder |

## Check Your Understanding

You should now be able to explain:

* what Sysmon adds to normal Windows logging
* where Sysmon events are stored
* why command line information is useful
* why parent and child process relationships matter
* why Process GUID can help with correlation
* how a process can be linked to a network connection
* how a process can be linked to a file creation event

## Simple Investigation Test

Generate one small activity of your choice using tools already used in this section.

Then answer:

1. What happened?
2. Which process was involved?
3. Which user performed the action?
4. What other process started it?
5. Did it create a file or make a network connection?
6. Does the activity match what you expected?

If you can answer those questions using the event data, the section has achieved its purpose.

## Snapshot

If `CLIENT01` is working correctly and you want a recovery point before later monitoring changes, create a VMware snapshot with a clear name such as:

```
CLIENT01 Sysmon Baseline
```

## Key Takeaways

* Sysmon provides detailed endpoint telemetry.
* Event ID `1` shows process creation.
* Event ID `3` can show selected network connections.
* Event ID `11` can show file creation.
* Process context is often more useful than a process name alone.
* Several related events can be combined into a simple investigation timeline.
* More telemetry is not automatically better. Useful configuration and clear investigation questions matter.

## Next Stage

The next ZyberLab section can move into basic network visibility using tools such as `ipconfig`, `ping`, `nslookup`, `netstat`, and a small Nmap lab.

The environment does not need additional infrastructure yet. The existing `DC01` and `CLIENT01` systems are enough for the next learning stage.