forgot to add sysmon_toggle_part3