sysmon: Add actions