Configuration, Noise & Correlation
What is it?
A Sysmon config decides what to log and what to exclude. Good tuning drops predictable noise and keeps signal. Correlation ties related events together — most reliably by ProcessGuid, the stable id shared by all events of one process.
Why it matters
An unfiltered Sysmon is unusable noise; a tuned one is a precision instrument. And a single event rarely tells the story — correlating a process's create, network and file events by ProcessGuid is what reconstructs an action.
Where you see it
A tuned config excludes known-good (e.g. an updater's connections) and includes high-value events. In analysis, you filter all events sharing one ProcessGuid to see everything one process did.
What normal looks like
A manageable event volume dominated by meaningful events, with routine noise excluded by config.
What suspicious looks like
Not the config itself — but a ProcessGuid whose correlated events form a chain of execute → connect → drop → persist is the shape of an intrusion.
How analysts investigate
Trust a tuned config to reduce noise, then pivot: take a suspicious event's ProcessGuid and pull every event with it to see the whole action, ordered by time.
Common beginner mistakes
- Excluding so much in config that real signal is lost, or excluding nothing and drowning.
- Analyzing events one by one instead of correlating them by ProcessGuid.
Tune the noise out, tie the signal together
correlate by ProcessGuid {abc-123}:
EID1 10:02:33 powershell.exe -enc ... (create)
EID3 10:02:34 → 45.9.148.200:443 (connect)
EID11 10:02:35 wrote Public\svc.exe (drop)
EID13 10:02:36 Run key → svc.exe (persist)
one GUID, four events, one coherent attack actionQuick check
What is the most reliable way to gather everything ONE process did?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.