# Event ID 4: Sysmon service state changed
###### Version: 4.81

## Description
The **service state change** event reports the state of the Sysmon service (started or stopped).

## Data Dictionary
|Field Name|Type|Description|Sample Value|
|---|---|---|---|
|UtcTime|date|Time in UTC when event was created|`2021-10-15T00:26:12.0920000Z`|
|State|string|sysmon service state (i.e. stopped)|`Started`|
|Version|string|sysmon version|`1.0.0`|
|SchemaVersion|string|sysmon config schema version|`4.81`|