This is part 2 in which we will be setting up Sysmon in our WEF server. As you saw in the previous article, there is no option for Sysmon subscription under event viewer. Let’s resolve that.
Step 1: Setup Sysmon
Download Sysmon from here: https://technet.microsoft.com/en-us/sysinternals/sysmon
1. Extract to a local destination
2.Launch a command prompt with elevated privileges(right click-run as Administrator)
3.Run the following command: Sysmon.exe -I -h sha256 -n /accepteula
4.You should then see a message similar to the screenshot below, and eventually see the service Sysmon getting started.
5. Verify that sysmon is running by going to windows services. 
6. Reboot your system.
7. Now go back and create a new subscription for Sysmon
Done!
Let’s continue on creating a GPO to finally collect endpoint logs in Part 3/3