# How to activate sysmon event ID 3

**URL:** <https://discuss.elastic.co/t/how-to-activate-sysmon-event-id-3/345977>\
**Category:** Kibana\
**Created:** [October 29, 2023, 11:10am UTC](https://discuss.elastic.co/t/how-to-activate-sysmon-event-id-3/345977 "2023-10-29T11:10:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![yassinebad](https://avatars.discourse-cdn.com/v4/letter/y/e8c25b/32.png) [@yassinebad](https://discuss.elastic.co/u/yassinebad)\
**Post date:** [October 29, 2023, 11:10am UTC](https://discuss.elastic.co/t/how-to-activate-sysmon-event-id-3/345977/1 "2023-10-29T11:10:10Z")

</div>

Hey everyone,  
I am sending my logs from a windows node using winlogbeat and sysmon64 to my ELK stack.  
While in discover panel in kibana I can see my logs with different events ID of sysmon, but I have noticed that the event ID 3 for new connections is not working (I have made a test using RDP).  
When I have checked on the doc, they say that it's disabled by default.  
How can I enable it ???  
Thanks

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [October 29, 2023, 3:51pm UTC](https://discuss.elastic.co/t/how-to-activate-sysmon-event-id-3/345977/2 "2023-10-29T15:51:26Z")

</div>

> [@yassinebad](#):
>
> When I have checked on the doc, they say that it's disabled by default.

That is really a sysmon question not a winlogbeat question.

Hi @yassinebad

If you do a search, there's plenty of articles on how to configure sysmon

Example and that's when I believe has ID3 enabled

> **[Sysmon: How To Setup, Configure, and Analyze the System Monitor’s Events](https://syedhasan010.medium.com/sysmon-how-to-setup-configure-and-analyze-the-system-monitors-events-930e9add78d)**
>
> Sysmon, short for System Monitor, is a utility tool developed by Mark Russinovich, as part of the Sysinternals suite. The utility is…

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 26, 2023, 3:52pm UTC](https://discuss.elastic.co/t/how-to-activate-sysmon-event-id-3/345977/3 "2023-11-26T15:52:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.