--audit_allow_config=true
--audit_allow_sockets=true
--audit_persist=true
--enable_audit=true
--enable_audit_process_events=true
--enable_ntfs_event_subscriber=true
--enable_ntfs_event_publisher=true
--enable_windows_events_subscriber=true
--enable_windows_events_publisher=true
--enable_powershell_events_subscriber=true
--events_optimize=true
--events_max=45000
--events_expiry=86400
--disable_events=false
--windows_event_channels=System,Application,Setup,Security