following the advices given to me I changed the category and the filter to be closer to sysmon field.