Can Sysmon logs completely take the place of certain "Event Logs"?

[Kinngk789]

So we are wondering if by implementing the collection of Sysmon logs, we can stop collecting other logs all together.

Can Sysmon logs completely take the place of certain "Event Logs"? (ie. it includes the event log data + additional data)
Or is it a completely different set of information altogether.

If we can sell that it will cut down on our index license usage, then management will definitely be all for it.

[dstaulcu]

A compelling argument could be made that Sysmon Process Create and Process Terminate logs could could take the place of the Process Creation/Termination subcategories of the Detailed Tracking category of events in the Security event log. The security event log provides for >=48 other subcategories of events though, so you you should not drop collection of security logs altogether.