Sysmon Configuration Error

{
  "sysmon_error": {
    "EventID": 255,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection_error": {
    "Description
| contains": [
      "Failed to open service configuration with error",
      "Failed to connect to the driver to update configuration"
    ]
  },
  "filter_generic_english": {
    "Description
| contains
| all": [
      "Failed to open service configuration with error",
      "Last error: The media is write protected."
    ]
  },
  "filter_generic_french": {
    "Description
| contains
| all": [
      "Failed to open service configuration with error",
      "Last error: Média protégé en écriture."
    ]
  },
  "filter_by_errorcode": {
    "Description
| contains": [
      "Failed to open service configuration with error 19",
      "Failed to open service configuration with error 93"
    ]
  },
  "condition": "sysmon_error and (selection_error and not 1 of filter*)"
}

False Positives

• ⚠ Legitimate administrative action