Introduction

When I first started learning about Security Information and Event Management (SIEM) platforms, I understood the theory: collect logs from multiple systems, correlate events, and give defenders a centralized place to investigate suspicious activity. But understanding the theory is very different from watching those logs appear in real time after you've generated them yourself.

For this project, I deployed and enhanced a Wazuh SIEM environment in CloudShare and explored how Windows endpoint telemetry changes after tuning Sysmon. I wanted to answer a simple question: what does normal activity actually look like from a defender's perspective? To find out, I generated file system changes, administrative commands, and PowerShell activity, then watched how Wazuh collected, organized, and presented those events.

The technical side of the project was rewarding, but what surprised me most was how much I learned from the mistakes I made along the way. A couple of small configuration errors forced me to slow down, read documentation more carefully, and approach troubleshooting more methodically. Those moments ultimately taught me more than the experiments themselves.

My name is Michael Cooke, and I'm transitioning into cybersecurity after working in marketing and client-facing roles. This is my first contribution to the cybersecurity community, and I hope someone beginning their own blue team journey finds this story helpful—or at least avoids making a couple of the mistakes I did.

Setup

Before making any changes, I established a baseline by verifying that the Wazuh agent was communicating correctly and that Sysmon was installed. I checked the installation, reviewed the active configuration, and exported a backup before making modifications.

Commands used:

  • sysmon64 -s
  • sysmon64 -c
  • sc query type= service | findstr /I Sysmon

My primary modification was tuning the Sysmon configuration to improve logging for process creation, PowerShell activity, and file-related events. My goal was to improve the quality of endpoint telemetry rather than simply collect more logs.

During setup I encountered two mistakes. First, I used an incorrect Windows Registry path containing escaped backslashes, resulting in an “Invalid key name” error. After comparing my command with Microsoft's documentation, I corrected the syntax, and the command worked successfully.

Later, I attempted to verify the Sysmon service using 'sc query Sysmon'. Windows reported that the service did not exist. After investigating, I discovered the installed service was actually named 'Sysmon64'. This reinforced the importance of verifying assumptions before troubleshooting.

Experiment Time!

Experiment 1—File Integrity Monitoring

I created, modified, renamed, and deleted a file inside a monitored directory while observing Wazuh. The SIEM successfully detected each change, demonstrating how file integrity monitoring provides valuable evidence during investigations.

Experiment 2 – Administrative Activity

I executed common administrative commands including whoami, hostname, ipconfig, and systeminfo. Wazuh recorded authentication and process creation events, showing how even legitimate administrative activity creates useful forensic evidence.

Experiment 3—PowerShell Activity

I executed Get-Process, Get-Service, Get-LocalUser, and Get-NetTCPConnection. Sysmon generated detailed process creation telemetry that Wazuh successfully ingested, demonstrating how enhanced logging improves endpoint visibility.

Experiment Mistake

While reviewing my results, I initially believed my configuration changes had failed because I could not locate the expected events. The issue turned out to be an incorrect dashboard time range rather than a configuration problem. Verifying search filters resolved the issue immediately.

Conclusion

This project demonstrated how Wazuh and Sysmon work together to provide meaningful endpoint visibility. File integrity monitoring captured file modifications, administrative commands produced useful forensic evidence, and PowerShell activity generated detailed telemetry that supported the investigation.

The biggest lesson I learned was to always verify your environment before making changes. Export configurations, confirm services are running, document every modification, and carefully read error messages before assuming something is broken. Small mistakes during setup and experimentation became valuable learning opportunities.

Final Thoughts

5.1 The Coolest Thing I Learned

The coolest thing I learned was how ordinary Windows activity becomes valuable evidence inside a SIEM. Watching everyday commands appear as searchable telemetry helped me appreciate the importance of centralized logging and detection engineering.

5.2 Advice for Another Beginner

Don't rush. Establish a baseline, export your configurations, take screenshots, and document every command you execute. Your troubleshooting notes will often become your best learning resource.

5.3 Favorite Resource

The official Wazuh documentation was the resource I relied on most. It clearly explained configuration, troubleshooting, and alert interpretation, making it invaluable throughout this project.

5.4 Thank You

I'd like to thank Olaf Hartong for Sysmon Modular and Florian Roth (Neo23x0) for his Sysmon configuration repository. Their work helped me better understand endpoint telemetry and logging best practices.

Annotated References

  1. Wazuh Inc. (n.d.). Wazuh Documentation. https://documentation.wazuh.com
    Primary reference for Wazuh deployment, configuration, and alert interpretation.

  2. Microsoft Sysinternals. (n.d.). Sysmon (System Monitor).
    Helped me understand Sysmon installation and event logging.

  3. MITRE Corporation. (n.d.). MITRE ATT&CK Framework.
    Provided context for mapping observed behavior to adversary techniques.

  4. Olaf Hartong. (n.d.). Sysmon Modular.
    Demonstrated best practices for Sysmon configuration.

  5. Florian Roth (Neo23x0). (n.d.). Sysmon Configuration.
    Offered production-ready examples for endpoint logging.

  6. MalwareArchaeology. (n.d.). Windows Logging Cheat Sheets.
    Improved my understanding of Windows event logging.

  7. Microsoft. (n.d.). Windows Security Auditing.
    Explained Windows security events and auditing.

  8. Microsoft. (n.d.). PowerShell Documentation.
    Supported the PowerShell experiment.

  9. TripleTen Cybersecurity Bootcamp. (2026). Sysmon and Wazuh Live Session.
    Reinforced concepts used during deployment.

  10. TripleTen Cybersecurity Bootcamp. (2026). Continuous Monitoring Live Session.
    Connected technical implementation to SOC monitoring workflows.