SwiftOnSecurity
Where are Windows Event ID???
Started logging events and modifying config. All these events are Sysmon event IDs. Is there proper configuration to use to include Windows actual Event IDs instead of Sysmon? My use cases for SIEM search are trigger alerts based on Windows Event IDs not Sysmon's own version of Eevent ID like 1, 2, 3, 4, 5,11... etc. I'm in need of collecting actual events that are windows generated Event IDs.
Am I the only one asking this or has there been a thread about this?
Sysmon is designed for enhanced Windows auditing. It is separate from the built-in Windows auditing.
Read more about Sysmon here:
https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#introduction
You can view how to enable auditing for specific Windows Event IDs:
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings
