Glossary: Logs and Data Sources for Investigations
Sysmon
Microsoft's free tool that adds detailed endpoint events to the Windows event log. Event ID 1 is a process created and event ID 3 is a network connection.
Glossary: Logs and Data Sources for Investigations
Microsoft's free tool that adds detailed endpoint events to the Windows event log. Event ID 1 is a process created and event ID 3 is a network connection.