HELK query

helk> Sysmon EventID=1

Query the HELK hunting stack (Elastic + Kafka + Spark) to search for Sysmon events, starting with process creation (EventID 1).

Run it when you have HELK deployed as a hunting platform (Roberto Rodriguez's open source stack: Elasticsearch, Logstash, Kafka, and Spark with Sysmon logs) and you want to explore endpoint telemetry. The base query by EventID 1 gives you process creation across the fleet, and from there you filter by CommandLine, Image, or user to hunt for anomalies. HELK is the quintessential learning platform for hunting: the full stack in a docker-compose, with Sysmon data already normalized. The example query is the starting point — the real hunting is in the variations (unsigned processes, weird cmdlines, unexpected parents).

Don't use it if your environment doesn't have Sysmon deployed: HELK without Sysmon telemetry is an empty platform — the value is in the data, not the stack. And watch out for performance: queries without a time filter on an Elasticsearch with months of data take a while; always scope with the time range. HELK is a hunting and learning platform, not a production SIEM with alerts and cases: for daily operational detection you need Elastic rules and the alert flow; HELK is the lab where you develop them.