An anomaly observed in the Sysmon event stream was linked to a configuration change rather than to an identified security incident.
The cause was the implementation of a new Sysmon configuration containing a new set of rules used for ingesting Sysmon events.
Event Location
Location: EventChannel
Channel: Sysmon
The observed activity originated from Sysmon telemetry being ingested into the monitoring platform.
Cause of the Event Change
The anomaly was caused by the implementation of a new configuration.
This configuration introduced a new set of rules for ingesting Sysmon events.
As a result, the characteristics of the event stream changed and the monitoring platform observed a different event pattern.
Configuration Changes and Anomaly Detection
Changes to event-ingestion rules can directly influence the type and volume of telemetry received by a monitoring system.
When a new configuration is introduced, previously observed patterns may change even when there is no underlying security issue.
In this case, the change in Sysmon activity was explained by the newly implemented ingestion configuration.
Operational Context
The important context for this anomaly is that the change in event activity occurred after the introduction of a new Sysmon configuration.
Understanding recent configuration changes is therefore important when analysing anomalies affecting telemetry sources.
Conclusion
The Sysmon anomaly was caused by the implementation of a new configuration with a new set of rules for ingesting Sysmon events.
The observed event change was therefore configuration-driven and reflected a modification in telemetry ingestion.
