Seriously just use the swiftonsecurity config - it's way better than what you're doing now.
Seriously just use https://github.com/SwiftOnSecurity/sysmon-config