It should not be that many, as i am testing with my laptop and a testing vm for now. For the flags, i have not made any change for the ones i used in 4.6.0:

--disable_events=false

--enable_windows_events_subscriber=true

--enable_windows_events_publisher=true

--enable_powershell_events_subscriber=true

and my channels are as in :

windows_event_channels: System,Application,Setup,Security,Microsoft-Windows-PowerShell/Operational,ForwardedEvents