Sysmon - Log unsuccessful network connections

Question

Recently installed sysmon and noticed that it only logs established network connections. Is it possible to also log network connections that get blocked or reset? Or if anyone is aware of a way to log these types of connections without using sysmon I am all ears

Answer 1

Network connection block or reset logging is not currently available through sysmon. Within sysmon the closest I would think you could get is to monitor for dns query activity which is not followed by network connection to corresponding dns query result ip.

For blocking events I would focus on correlation of logs from host or network firewall or intrusion detection applications. For reset events i would consider monitoring of protocol analysis such as netflow or splunk stream.

It would be cool if sysmon had a way of capturing such events though.