Correlating Sysmon Event Logs and Packet Captures for Enhanced Digital Forensics and Incident Response

This paper outlines a systematic approach to correlate telemetry data from Microsoft Sysmon with packet-level information obtained from Wireshark. By examining Sysmon Event ID 3 logs in conjunction with filtered PCAP traffic (including DNS, HTTP, ICMP, TCP), we illustrate how integrating endpoint and network insights improves digital forensics and incident response (DFIR). The research confirms monitoring effectiveness through ICMP testing, reveals limitations in logging configurations, and emphasizes the importance of using multi-source telemetry. The proposed methodology and findings contribute to training, academic inquiry, and best practices in operational security.