Sysmon event IDs

Sysmon (System Monitor, from Microsoft Sysinternals) writes what Windows' own Security log leaves out: process creation with hashes and the parent's command line, network connections per process, one process opening another, files created, registry changes, DNS queries. Every event goes to Microsoft-Windows-Sysmon/Operational on the machine where it happened, and Sysmon logs only what its configuration file asks for: most events are filtered by the configuration element in the table below.

The table lists every event Microsoft documents, with Microsoft's own title and the number of fields Sysmon writes for it (from Sysmon's manifest, schema 4.90). The linked events have a page for investigators: what the event records, the fields that carry the signal, what an attack looks like, and KQL for Microsoft Sentinel, where Sysmon events land in the Event table.

Event ID	Microsoft's title	Config element	Fields
1	Process creation A process started — Sysmon records what ran, its full command line, file hashes and version information, the parent process with its command line, the account and the logon session it ran in.	<ProcessCreate>	23
2	A process changed a file creation time	<FileCreateTime>	9
3	Network connection A process made or received a TCP or UDP connection — Sysmon records which executable, under which account, from which address and port to which address and port, and whether the machine initiated it.	<NetworkConnect>	18
4	Sysmon service state changed	—	4
5	Process terminated	<ProcessTerminate>	6
6	Driver loaded	<DriverLoad>	7
7	Image loaded	<ImageLoad>	16
8	CreateRemoteThread	<CreateRemoteThread>	14
9	RawAccessRead	<RawAccessRead>	7
10	ProcessAccess One process opened a handle to another — Sysmon records which process asked, which process it opened, the access rights it was granted and the call stack that made the request.	<ProcessAccess>	13
11	FileCreate A file was created or overwritten — Sysmon records the full path, the time the file was created and the process and account that wrote it.	<FileCreate>	8
12	RegistryEvent (Object create and delete)	<RegistryEvent>	8
13	RegistryEvent (Value Set) A process wrote a registry value — Sysmon records the full value path, the data written for numeric values, and the process and account that wrote it.	<RegistryEvent>	9
14	RegistryEvent (Key and Value Rename)	<RegistryEvent>	9
15	FileCreateStreamHash	<FileCreateStreamHash>	10
16	ServiceConfigurationChange	—	3
17	PipeEvent (Pipe Created)	<PipeEvent>	8
18	PipeEvent (Pipe Connected)	<PipeEvent>	8
19	WmiEvent (WmiEventFilter activity detected)	<WmiEvent>	8
20	WmiEvent (WmiEventConsumer activity detected)	<WmiEvent>	8
21	WmiEvent (WmiEventConsumerToFilter activity detected)	<WmiEvent>	7
22	DNSEvent (DNS query) A process looked up a name in DNS — Sysmon records which process asked, the name, the status of the answer and the addresses it returned, whether the answer came from the network or the cache.	<DnsQuery>	9
23	FileDelete (File Delete archived)	<FileDelete>	10
24	ClipboardChange (New content in the clipboard)	<ClipboardChange>	10
25	ProcessTampering (Process image change)	<ProcessTampering>	7
26	FileDeleteDetected (File Delete logged)	<FileDeleteDetected>	9
27	FileBlockExecutable	—	—
28	FileBlockShredding	—	—
29	FileExecutableDetected	—	—
255	Error	—	3

Titles from Microsoft's Sysmon documentation. Events without a field count are documented by Microsoft but not defined in the open-source Sysmon manifest.

Sysmon events in Microsoft Sentinel

Collected by the Azure Monitor Agent, Sysmon events are rows of the Event table with Source set to Microsoft-Windows-Sysmon; their fields are inside the EventData XML. One way to read them as columns:

Event
| where Source == "Microsoft-Windows-Sysmon"
| extend D = parse_xml(EventData).DataItem.EventData.Data
| mv-apply d = D on (summarize f = make_bag(bag_pack(tostring(d["@Name"]), tostring(d["#text"]))))
| summarize Events = count() by EventID
| order by EventID asc

That count per event ID also shows what your configuration actually logs: an event ID missing from the result is one the configuration does not ask for. With no SIEM, open the .evtx file in the EVTX viewer, which reads it in the browser.

Investigating a Windows host?

Load the Sysmon and Security logs into the free browser analyzer: LSASS access, remote threads, suspicious command lines, Kerberoasting and logon attacks, with the evidence for each. Nothing is uploaded.

Open the free analyzer → Analyze your own logs

Investigating something right now? LogTriage checks every address in the file against threat intelligence and writes the incident report: 10 analyses a month free. The incident pack adds the in-depth AI analysis and files up to 100 MB: 25 analyses for $19, one payment, no subscription. Pricing

Every query on this site's reference pages, the Sigma rules and a cheat sheet in one download: the Incident Response Kit, $29 once.