[eventtype=ms-sysmon-network]
network = enabled
communicate = enabled
port = enabled
listening = enabled

[eventtype=ms-sysmon-process]
process = enabled
report = enabled

[eventtype=ms-sysmon-filemod]
change = enabled
endpoint = enabled
filesystem = enabled

[eventtype=ms-sysmon-regmod]
change = enabled
endpoint = enabled
registry = enabled

[eventtype=ms-sysmon-wmimod]
change = enabled
endpoint = enabled

[eventtype=ms-sysmon-dns]
network = enabled
resolution = enabled
dns = enabled
