Getting Data In

Can Sysmon logs completely take the place of certain "Event Logs"?

Kinngk789
New Member

So we are wondering if by implementing the collection of Sysmon logs, we can stop collecting other logs all together.

Can Sysmon logs completely take the place of certain "Event Logs"? (ie. it includes the event log data + additional data)
Or is it a completely different set of information altogether.

If we can sell that it will cut down on our index license usage, then management will definitely be all for it.

0 Karma

dstaulcu
Builder

A compelling argument could be made that Sysmon Process Create and Process Terminate logs could could take the place of the Process Creation/Termination subcategories of the Detailed Tracking category of events in the Security event log. The security event log provides for >=48 other subcategories of events though, so you you should not drop collection of security logs altogether.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...