In your poc, is sysmon still outputting events to the eventlog? Your poc just allows us to more easily manipulate the sysmon data without having to use the

windows_events

table to ship the sysmon logs?

yes sysmon still outputs it's log via it's own trace session. we create a new trace session to receive the events and fwd accordingly. If you notice there are 2 trace sessions, one that we create from event publisher.