# Sysmon registry logs don't get to elastic

**URL:** <https://discuss.elastic.co/t/sysmon-registry-logs-dont-get-to-elastic/374772>\
**Category:** SIEM\
**Tags:** windows\
**Created:** [February 19, 2025, 1:53pm UTC](https://discuss.elastic.co/t/sysmon-registry-logs-dont-get-to-elastic/374772 "2025-02-19T13:53:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pok\_lehbim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pok_lehbim/32/140579_2.png) [@pok\_lehbim](https://discuss.elastic.co/u/pok_lehbim)\
**Post date:** [February 19, 2025, 1:53pm UTC](https://discuss.elastic.co/t/sysmon-registry-logs-dont-get-to-elastic/374772/1 "2025-02-19T13:53:36Z")

</div>

I'm trying to set up the detection rule called "Privilege Escalation via Windir Environment Variable" but the data that this rule relies upon isn't getting to elastic. I've made sure to have everything set up correctly, and yet I'm not receiving the desired logs.

Here's my checklist to ensure a sensible setup for this AFAIK:

- Sysmon Operational toggle in the windows integration settings is ON.
- Default sysmon config.
- Relevant fields are indeed in the index mappings.
- Local logs, reveal that everything is correctly being logged in **event viewer** -- _ **Microsoft-Windows-Sysmon/Operational** _

Since it is mentioned in the related integrations section, I added elastic defend as well to see if that would fix anything. That did add _ **some** _ registry events but nothing that is relevant to the rule. Furthermore, the only events that are getting fetched are automatic system changes. Anything manual I try for testing purposes doesn't appear in elastic at all.

Has anyone experienced something similar? Are there known ways to fix this?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 19, 2025, 1:53pm UTC](https://discuss.elastic.co/t/sysmon-registry-logs-dont-get-to-elastic/374772/2 "2025-03-19T13:53:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.