Developer Documents Sysmon and Wazuh SIEM Detection Setup, Learns From Troubleshooting

A cybersecurity learner set out to explore what Microsoft's Sysmon tool can capture by tuning its configuration on a Windows endpoint and forwarding logs to the Wazuh SIEM platform. The project involved modifying an existing Sysmon XML configuration file on a Windows server by removing an exclusion for the conhost.exe process to increase process telemetry. After applying the change, the expected conhost.exe Process Create events (Event ID 1) did not appear as anticipated, prompting deeper investigation into how Sysmon records process creation. The experience highlighted that effective SIEM detection requires not just log collection but also a clear understanding of what to look for and how to validate test results accurately. The author noted that troubleshooting self-made errors proved to be a valuable learning experience in understanding the investigative side of cybersecurity.