@alessandrogario Alright awesome sauce I put this in .flags file and it's doing the thing, thanks.

--audit_allow_config=true
--audit_allow_sockets=true
--audit_persist=true
--enable_audit=true
--enable_audit_process_events=true
--enable_ntfs_event_publisher=true
--enable_windows_events_subscriber=true
--enable_windows_events_publisher=true
--enable_powershell_events_subscriber=true
--events_optimize=true
--disable_events=false
--windows_event_channels=System,Application,Setup,Security