> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/08-wazuh-security-monitoring-basics/verify-sysmon-events.md).

# Verify Sysmon Events in Wazuh

`CLIENT01` already uses Sysmon for endpoint visibility. This lab checks whether that telemetry can also be reviewed through Wazuh.

## Objective

Generate a simple Sysmon event on `CLIENT01`, verify it locally, and then locate the related telemetry in Wazuh.

## Generate Known Activity

Use a normal application so the test is easy to understand.

For example:

1. open Command Prompt
2. run:

```
whoami
```

3. close Command Prompt

This should generate process activity when Sysmon process creation logging is enabled.

## Verify Locally

On `CLIENT01`, open:

```
Applications and Services Logs
Microsoft
Windows
Sysmon
Operational
```

Look for a recent process creation event, commonly Sysmon Event ID `1`.

Confirm that the event relates to the process you intentionally started.

## Find the Event in Wazuh

Open the Wazuh dashboard and search around the same time window.

Use fields such as:

* agent name `CLIENT01`
* Sysmon event ID
* image or process name
* username
* timestamp

The exact fields available depend on the Wazuh version and the Sysmon configuration being used.

## Compare the Evidence

Compare the Wazuh record with the original Sysmon event.

Confirm that the central record represents the same activity.

## What You Should Learn

The useful part of endpoint telemetry is not simply having more logs. The value comes from being able to answer questions such as:

* What process executed?
* Which user context was involved?
* What started the process?
* When did it happen?
* Did the process make a network connection?
* Is the activity expected for this endpoint?

## Verification

The lab is complete when:

* the Sysmon event exists locally on `CLIENT01`
* the corresponding telemetry can be found in Wazuh
* the host, process, and time match
* you can explain why centralized Sysmon data is useful during an investigation

## Security Relevance

Sysmon adds endpoint context that Windows Security logs may not provide by themselves. Centralizing that telemetry makes it easier to correlate authentication, process, file, and network activity during an investigation.