Paul Masek

Had this same issue while testing out different ways to deploy Sysmon and an internally customized version of @SwiftOnSecurity 's config. Just restart Event Viewer. "Event Viewer was not restarted...

There could just be a sysmon -c view issue that's preventing the excludes in those two Event IDs from being displayed. The main issue I have though is that I...

I've spoken with another colleague who also wasn't able to get additional exclusions working for Event ID 3 in z-AlphaVersion.xml. He came to this finding completely separate from me.

@grokdesigns I'm on 10.2 now as well. I made your recommended change of breaking out inclusions/exclusions for the same event types into different rule groups. That fixed it for me...

Thanks for creating it so quickly after Sysmon v10 was released. I'll be sure to try out rules made here once you start developing them.

What about additions to the decoder? For example should there be an entry in https://github.com/wazuh/wazuh-ruleset/blob/master/decoders/0380-windows_decoders.xml for the new Event ID 22: DNSEvent (DNS query)?

We're on the latest version, 3.9.2. Thanks for your work on this invaluable feature!