Enable built-in Sysmon in Windows 11 with PowerShell

Windows 11 now includes System Monitor (Sysmon), a tool that logs process creation, network connections, and file creation time changes to the Windows event log. Previously, it was a separate download from Sysinternals. The built-in version is an optional feature that is disabled by default, so you must enable it with PowerShell and install it with the sysmon command. This article explains the prerequisites, the commands, how to apply your own XML configuration, and how to verify that Sysmon writes events.
Source

👉@sysadminoff

https://4sysops.com/archives/enable-built-in-sysmon-in-windows-11-with-powershell/