It is under its own log...so it can be a little hard to find. When you open the event log it is under:
"Applications and Services Logs/Microsoft/Windows/Sysmon/Operational"
The log can build up fast, and it can impact system performance, so use it carefully.
Each entry will show you user, process, and time info:
More info about it from Sysinternals Site