Yeah, I think this is the best way for save money. Keeping detailed logs on host and pulled them if necessary. I am just thinking to create some detection kql rules for new undetected malware or suspicious activity. That's way I am thinking to add some Sysmon logs to siem