Sysmon: the log is only as wide as the config

One log, many event IDs

System Monitor is a Windows service that records selected activity into Microsoft-Windows-Sysmon/Operational. Each record has an event ID. The ID is the type: 1 is a process being created, 3 is a network connection, 11 is a file create, 13 is a registry value being set, 22 is a DNS query. The IDs are stable names. You cite the ID and the field, not a paraphrase that could be any of them. A case that says “Sysmon saw the file” is unfinished until it says which ID and which path.

For NL-2026-041 the SOC already exported that log from NL-FIN-14 for the morning of 15 April. You hash the export and note the host. You are reading a copy. You are not turning logging on or off on a machine outside the lab, and you are not writing a configuration whose purpose is to drop events. The useful work is to learn what this export can answer.

The config decides what was even possible

Sysmon logs only the event types the installed configuration includes. Microsoft documents network connection logging as off until a config enables it. DNS, file creates, and registry events are similarly dependent on filters. Process creation is the type most installs record first, and even that can be filtered. Before you conclude that the laptop made no connections, find the configuration that was loaded. Event ID 16 records a configuration change. The on-disk config file, if the image still has it, is the rest of the story. Autopsy can hash that file. The export’s gaps have to be read against it.

A filter can include or exclude. An export full of Event ID 1 and empty of Event ID 3 may be a host that did not connect, or a config that never turned network logging on. Those two sentences lead to different work. Write which one you have evidence for. If the config is not in the image and Event ID 16 is absent, say the config is unknown and treat missing IDs as unknown, not as absence of the activity.

• Event ID 1, ProcessCreate, a new process.
• Event ID 3, NetworkConnect, a TCP or UDP connection. Often disabled until configured.
• Event ID 11, FileCreate, a file created or overwritten.
• Event ID 12, 13, and 14, registry create or delete, value set, and rename.
• Event ID 22, DnsQuery, a name lookup.
• Event ID 16, the configuration changed. Not a host artifact, a Sysmon artifact.

UtcTime and ProcessGuid are the joins

Almost every event has UtcTime. The field is UTC, which you already know how to convert to America/New_York. Do the conversion once, in the case note, and keep UtcTime in the quote so a reader can see you did not shift the export itself. A 13:17 UTC process create is 09:17 Brooklyn on this April date.

ProcessGuid is the identifier you join on. The value in these notes is shortened to {1b2c-4812}. The CSV contains the full GUID, and the full value is what you filter on. It is meant to stay unique for that process instance even when Windows reuses a pid. Parent and child both carry GUIDs on a process-create event, so you can walk a tree inside the export. A network event with the same ProcessGuid is the same instance, if the config logged both. Pid alone will lie to you across the morning. Prefer the GUID in every sentence that ties two IDs together.

Know the shape of the file you were given

An EVTX, an XML export, and a CSV are the same events in different wrappers. Field names should match the Sysmon schema: Image, CommandLine, DestinationIp, TargetFilename, QueryName. If a column was renamed by the SIEM, write the mapping once at the top of the note. Then stop translating. Quoting DestinationIp as “the server” loses the port and the protocol.

Record the time range of the export. A file that starts at 09:30 cannot answer a question about 09:17. That is the same class of limit as a memory snapshot taken at 09:22. The disk can still have the file. The log can only show the window it contains, for the IDs the config allowed.

Worked case: the export covers the window, and network is enabled

The CSV is named NL-FIN-14-sysmon-2026-04-15.csv, hashed, and it contains events from 12:00 to 16:00 UTC, which covers 08:00 to 12:00 Brooklyn. Event ID 16 is absent. The image still has the Sysmon config file the SOC said they deployed. You read it in Autopsy and see process creation, file create, registry value set, DNS, and network connection included. You write “network events were configured on, so a missing Event ID 3 in the window is meaningful.”

You convert nothing in the CSV itself. The case log says display times in the write-up are America/New_York and quotes remain UtcTime. ProcessGuid is the join key you will use for the rest of the Sysmon lessons.