> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/06-network-security-basics/correlate-network-activity.md).

# Correlate Network Activity with Endpoint Logs

This lab connects the network exercises with the Sysmon work completed earlier.

## Objective

Generate a simple connection to `CLIENT01`, then compare what is visible from the testing workstation with what is recorded on the endpoint.

## Prepare CLIENT01

Confirm that Sysmon is running and that network connection events are available in the Sysmon Operational log.

Open Event Viewer and navigate to:

```
Applications and Services Logs
Microsoft
Windows
Sysmon
Operational
```

## Generate Lab Activity

From `KALI01`, perform a basic connection or service discovery test against `CLIENT01` using the lab IP address.

You can use the basic Nmap command from the previous exercise:

```
nmap <CLIENT01-IP>
```

## Review CLIENT01

On `CLIENT01`, review recent Sysmon events.

Focus on Event ID `3` if network connection logging is enabled by the Sysmon configuration.

Look for useful fields such as:

* Process image
* Source IP address
* Source port
* Destination IP address
* Destination port
* Protocol

Not every incoming probe will necessarily appear in the same way. Sysmon records network connections associated with processes on the endpoint, and the available evidence depends on the activity and configuration.

## Compare the Two Views

From `KALI01`, you know:

* Which system initiated the test
* Which IP address was targeted
* Which ports were checked

From `CLIENT01`, endpoint evidence may show:

* Which local process handled a connection
* Which protocol was involved
* Which local or remote addresses were associated with the event

## Build a Small Timeline

Write a short note such as:

```
Time:
Source system: KALI01
Target system: CLIENT01
Activity performed:
Network observation:
Endpoint observation:
Conclusion:
```

## Verification

The lab is complete when you can compare the network side and endpoint side of the same activity.

## Security Relevance

Security investigations become stronger when multiple sources support the same conclusion. Network observations can show where communication occurred, while endpoint telemetry can explain which process or service was involved.