AWS Cloudwatch Agent config for sysmin log

Question

I try to collect Sysmon logfiles with AWS CloudWatchAgent.

How do I need to specify the event_name section in the config?

I tried these

"event_name": "Microsoft-Windows-Sysmon"

then (most obvious)

"event_name": "Microsoft-Windows-Sysmon/Operational"

and this

"event_name": "Sysmon"

But nothing works ...

Thanks

Robert

Answer 1

"event_name": "Microsoft-Windows-Sysmon/Operational"

is correct.