add template of sysmon base on the example