Our Sysmon integration does not include mappings for some event types introduced since Sysmon v13.10. The current list of events we map to event.category and event.type can be viewed within the pipeline here. Useful blog with sample use cases for each event available here.

In order to fully support all Sysmon events, the following events should be supported:

• EventID 8: CreateRemoteThread | Sample Event
• EventID 9: RawAccessRead | Sample Event
• EventID 19: WmiEventFilter activity detected | Sample Event
• EventID 20: WmiEventConsumer activity detected | Sample Event
• EventID 27: FileBlockExecutable
• EventID 28: FileBlockShredding
• EventID 255: Error

This issue will track our progress on adding support for this new event type to our Sysmon integration.