Getting Data In

Can Sysmon logs completely take the place of certain "Event Logs"?

New Member

So we are wondering if by implementing the collection of Sysmon logs, we can stop collecting other logs all together.

Can Sysmon logs completely take the place of certain "Event Logs"? (ie. it includes the event log data + additional data)
Or is it a completely different set of information altogether.

If we can sell that it will cut down on our index license usage, then management will definitely be all for it.

0 Karma


A compelling argument could be made that Sysmon Process Create and Process Terminate logs could could take the place of the Process Creation/Termination subcategories of the Detailed Tracking category of events in the Security event log. The security event log provides for >=48 other subcategories of events though, so you you should not drop collection of security logs altogether.

0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...