Correlating Sysmon Event Logs and Packet Captures for Enhanced Digital Forensics and Incident Response
Year: 2025
Type: article
Abstract: This paper outlines a systematic approach to correlate telemetry data from Microsoft Sysmon with packet-level information obtained from Wireshark. By examining Sysmon Event ID 3 logs in conjunction with filtered PCAP traffic (including DNS, HTTP, ICMP, TCP), we illustrate how integrating endpoint and network insights improves digital forensics and incident response (DFIR). The research confirms monitoring effectiveness through ICMP testing, reveals limitations in logging configurations, and emphasizes the importance of using multi-source telemetry. The proposed methodology and findings contribute to training, academic inquiry, and best practices in operational security.
Author: Asif, Muhammad Huzaifa Asif
Language: English
Topic: Digital and Cyber Forensics
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7083418787
FWCI:
Cites:
Cited by:
Related to: