Direct answer
Correlate an observed network event with the recorded process identity and creation context on the same endpoint, then compare the connection with the application's expected behavior.
Understand available events
Microsoft documents Sysmon event classes including process creation and network connection events. The events available depend on the installed version and configuration; do not assume network connection logging is present on every device. Confirm the actual event source and forwarding path.
Reference: Microsoft: Sysmon event reference.
Correlate identifiers and time
Capture device, time, process identity, image path and connection details from the relevant records. Use the identifiers provided by the source and confirm the time window. A process identifier can be reused, so do not join distant events by numeric ID alone.
Investigate an example
A managed backup agent connecting to an approved storage service may be expected. The same endpoint connection from an unrecognized executable or unexpected destination should be checked with the software owner and network team. A destination or process name alone is not proof of malicious activity.
Preserve evidence and gaps
Retain the original records in restricted storage, document collection and timestamp limits, and use the incident process for unexplained activity. Avoid connecting to a suspicious destination or executing a file during triage. Tune collection with privacy and operations owners before expanding it.
Assessment limits
Sysmon is a source of observed telemetry, not a complete account of every process or connection. Configuration, device availability and retention affect coverage.
Frequently asked questions
Does every Sysmon deployment log network connections?
No. Verify the deployed configuration and available events on the relevant device.
Does a network event prove malicious behavior?
No. Correlate the process, destination and legitimate business context.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.