Sysmon v7 requires schema version update.

[swiftonsecurity]

Sysmon v7 requires schema version update.

[johnmccash]

Be aware that the rules for combining rule conditions have changed in 7.01:

From Sysmon 6.1:

• You can use both include and exclude rules for the same tag, where exclude rules override include rules. Within a rule, filter conditions on the same field have OR behavior, whereas conditions on different fields have AND behavior. In the sample configuration shown earlier, the networking filter
  uses both an include and exclude rule to capture activity to port 80 and 443 by all processes except those that have iexplore.exe in their name.

From Sysmon 7.01:

• You can use both include and exclude rules for the same tag, where exclude rules override include rules. Within a rule, filter conditions have OR behavior, In the sample configuration shown earlier, the networking filter uses both an include and exclude rule to capture activity to port 80 and 443
  by all processes except those that have iexplore.exe in their name.

Regards
John