Windows Event Logs & Sysmon

[wgawhh5hbnht]

What's everyone doing for collecting both Windows Event Logs & Sysmon?

Are you collecting all Even IDs or only a small subset?

What Sysmon config are you using? Have you tuned it to your environment or just using something like SwiftOnSecurity's Sysmon config?

I ask because our Windows license has grown from ~120G to ~250G and I need to reduce our license but don't want to miss anything.

[richgalloway]

One change you can make without missing anything is to remove the "boilerplate" that is attached to every Windows event.  Use SEDCMD in props.conf to remove the text beginning with "This event is generated...".