# Winlogbeat sending sysmon data to kibana

**URL:** <https://discuss.elastic.co/t/winlogbeat-sending-sysmon-data-to-kibana/154168>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [October 26, 2018, 10:00am UTC](https://discuss.elastic.co/t/winlogbeat-sending-sysmon-data-to-kibana/154168 "2018-10-26T10:00:33Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![godfather7](https://avatars.discourse-cdn.com/v4/letter/g/f07891/32.png) [@godfather7](https://discuss.elastic.co/u/godfather7)\
**Post date:** [October 26, 2018, 10:00am UTC](https://discuss.elastic.co/t/winlogbeat-sending-sysmon-data-to-kibana/154168/1 "2018-10-26T10:00:33Z")

</div>

in the kibana dashboard, winlogbeat records the sysmon event and send it to elasticsearch and henceforth to kibana. there are 3 field name on time basis and i am not able to understand the difference between them namely event\_data.PreviousCreationUtcTime, event\_data.UtcTime and event\_data.CreationUtcTime.  
 ![Screenshot%20(13)](https://us1.discourse-cdn.com/elastic/original/3X/5/2/52eb6cb584d868945bae22f5dccfb914712e54df.png)

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [October 29, 2018, 1:15pm UTC](https://discuss.elastic.co/t/winlogbeat-sending-sysmon-data-to-kibana/154168/2 "2018-10-29T13:15:41Z")

</div>

Hi,

The fields below `event_data` come from the raw Sysmon event and their meaning seems to depend on the event ID.

For these particular fields I've found: [https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90002](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90002)

It indicates that a file's creation time has been changed, being:

- UtcTime: Time the change occurred
- TargetFilename: Name of the file changed
- PreviousCreationUtcTime: Previous file creation time.
- CreationUtcTime: New file creation time.

---

<div class="post-metadata">

**Author:** ![godfather7](https://avatars.discourse-cdn.com/v4/letter/g/f07891/32.png) [@godfather7](https://discuss.elastic.co/u/godfather7)\
**Post date:** [October 30, 2018, 11:06am UTC](https://discuss.elastic.co/t/winlogbeat-sending-sysmon-data-to-kibana/154168/3 "2018-10-30T11:06:52Z")

</div>

Hi Adrisr,

Can this data can be manipulated to find out the launch time of a application?

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [October 30, 2018, 2:44pm UTC](https://discuss.elastic.co/t/winlogbeat-sending-sysmon-data-to-kibana/154168/4 "2018-10-30T14:44:33Z")

</div>

For that you have Event ID 1: Process Creation

> <https://github.com/Cyb3rWard0g/OSSEM/blob/master/data_dictionaries/windows/sysmon/event-1.md>

---

<div class="post-metadata">

**Author:** ![godfather7](https://avatars.discourse-cdn.com/v4/letter/g/f07891/32.png) [@godfather7](https://discuss.elastic.co/u/godfather7)\
**Post date:** [October 31, 2018, 6:18am UTC](https://discuss.elastic.co/t/winlogbeat-sending-sysmon-data-to-kibana/154168/5 "2018-10-31T06:18:04Z")

</div>

Hi,

By launch time i mean how much time it took to open an application and pop up on the screen.  
can sysmon and winlogbeat record this kind of data?

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [October 31, 2018, 6:29pm UTC](https://discuss.elastic.co/t/winlogbeat-sending-sysmon-data-to-kibana/154168/6 "2018-10-31T18:29:42Z")

</div>

I'm no expert, but I don't think Sysmon has support for that, as it is rather application-specific.

---

<div class="post-metadata">

**Author:** ![ssi](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@ssi](https://discuss.elastic.co/u/ssi)\
**Post date:** [November 8, 2018, 11:56am UTC](https://discuss.elastic.co/t/winlogbeat-sending-sysmon-data-to-kibana/154168/7 "2018-11-08T11:56:51Z")

</div>

hey

i dont think sysmon can provide "latency" in relation to process creation etc. here i would go for another sysinternals tool called procmon

if you google promon latency you get some good pointers

again assuming i understand your problem correctly.

---

<div class="post-metadata">

**Author:** ![godfather7](https://avatars.discourse-cdn.com/v4/letter/g/f07891/32.png) [@godfather7](https://discuss.elastic.co/u/godfather7)\
**Post date:** [November 19, 2018, 6:47am UTC](https://discuss.elastic.co/t/winlogbeat-sending-sysmon-data-to-kibana/154168/8 "2018-11-19T06:47:46Z")

</div>

Hi,

Procmon is giving data regarding the process creation but the duration of process creation is 0.000000 which is not theoretically possible. Is **relative duration** a correct measure to find out the launching time of the application? if yes, can we create logs of this and send the data to kibana through winlogbeat.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 17, 2018, 6:47am UTC](https://discuss.elastic.co/t/winlogbeat-sending-sysmon-data-to-kibana/154168/9 "2018-12-17T06:47:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.