> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/05-sysmon-and-endpoint-visibility/sysmon-endpoint-visibility.md).

# Sysmon and Endpoint Visibility Overview

This section introduces Sysmon as a simple way to observe activity on a Windows endpoint.

Windows Security logs are useful for authentication, account management, and audit events. Sysmon adds another layer of visibility by recording activity such as process creation, selected network connections, and file creation.

The goal is not to collect every possible Sysmon event. The goal is to learn how endpoint activity becomes useful security telemetry.

## Lab System

Use `CLIENT01` for the first Sysmon exercises.

Keeping the initial work on one client makes the logs easier to understand and avoids unnecessary changes on the domain controller.

## What You Will Learn

By the end of this section, you should be able to:

* install Sysmon on a Windows lab system
* locate the Sysmon Operational log
* understand Process Create events
* observe selected network connections
* observe file creation in a controlled folder
* identify parent and child process relationships
* correlate several events during a basic investigation

## Events Used in This Section

| Event ID | Activity           |
| -------- | ------------------ |
| 1        | Process creation   |
| 3        | Network connection |
| 11       | File creation      |

These events provide a simple starting point. Sysmon supports many additional event types, but they are intentionally left for later labs.

## Learning Approach

For each activity, follow the same pattern:

1. Generate one simple action.
2. Find the related event.
3. Read the important fields.
4. Explain what happened.
5. Decide why the event may matter during an investigation.

## Important Note

Sysmon provides telemetry. It does not decide whether an event is malicious, and it does not replace Microsoft Defender, EDR, SIEM, or other security controls.

A useful security investigation combines telemetry with context.

## Section Flow

Complete the pages in this order:

1. Install Sysmon on CLIENT01
2. Explore the Sysmon Operational Log
3. Observe Process Creation
4. Observe Network Connections
5. Observe File Creation
6. Understand Parent and Child Processes
7. Perform a Basic Endpoint Investigation
8. Complete the Sysmon Checkpoint

The section remains intentionally small so each event can be understood before more advanced endpoint monitoring is introduced.