Build a foundational Windows telemetry lab to understand how process creation data flows from an endpoint into a SIEM. This includes installing Sysmon, enabling Windows Security logging (Event ID 4688), and ingesting logs into Splunk Enterprise for analysis.

Platform: VirtualBox
OS: Windows 10 Home (unactivated, legal for lab use)
SIEM: Splunk Enterprise (local install)
Telemetry Sources:

• Windows Security Logs (4688)
• Sysmon (Event ID 1, 3) – verified in PowerShell

.\Sysmon64.exe -i -accepteula

Get-Service sysmon

Get-WinEvent -ListLog *sysmon*

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'} -MaxEvents 5

Since Windows 10 Home does not include secpol.msc, auditing was enabled manually:

auditpol /set /subcategory:"Process Creation" /success:enable

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 5

cd "C:\Program Files\Splunk\bin"
.\splunk status

• EventCode=4688 visible in Splunk
• Confirmed with:

index=* EventCode=4688

Sysmon is logging correctly on Windows and visible in PowerShell, but ingestion into Splunk will be completed in the next lab to avoid blocking initial project completion.

Screenshots included in /images folder for:

• Sysmon service running
• PowerShell Sysmon log verification
• 4688 event in Splunk
• Splunk Web UI running
• Security auditing commands

• How to install and validate Sysmon logging
• How Windows generates and stores process creation telemetry
• How to enable command-line auditing even on Windows Home
• How to install, repair, and restart Splunk safely
• Real-world troubleshooting:
  • Event Viewer snap-in failures
  • Splunkd service stuck in "Starting"
  • PID lock issues
  • VirtualBox ISO/boot errors
  • Clipboard integration not enabled by default
• How data flows from endpoint → event logs → SIEM
• Foundation for building detections based on process telemetry

• Add Sysmon → Splunk ingestion
• Build custom SPL searches
• Compare Sysmon Event ID 1 vs. Windows 4688
• Start identifying suspicious process behaviors
• Begin first detection rule write-up