Getting Data In

Can Sysmon logs completely take the place of certain "Event Logs"?

New Member

So we are wondering if by implementing the collection of Sysmon logs, we can stop collecting other logs all together.

Can Sysmon logs completely take the place of certain "Event Logs"? (ie. it includes the event log data + additional data)
Or is it a completely different set of information altogether.

If we can sell that it will cut down on our index license usage, then management will definitely be all for it.

0 Karma


A compelling argument could be made that Sysmon Process Create and Process Terminate logs could could take the place of the Process Creation/Termination subcategories of the Detailed Tracking category of events in the Security event log. The security event log provides for >=48 other subcategories of events though, so you you should not drop collection of security logs altogether.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...