[ms-sysmon-network]
search = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode="3"

[ms-sysmon-process]
search = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode="1" OR EventCode="5" OR EventCode="6" OR EventCode="8" OR EventCode="9" OR EventCode="10" OR EventCode="15" OR EventCode="17" OR EventCode="18")

[ms-sysmon-filemod]
search = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode="11" OR EventCode="2")

[ms-sysmon-regmod]
search = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode="12" OR EventCode="13" OR EventCode="14")

[ms-sysmon-wmimod]
search = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode="19" OR EventCode="20" OR EventCode="21")

[ms-sysmon-dns]
search = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode="22"
