[xml]$xml = Get-Content "sysmonconfig.xml"

# Remove all existing NetworkConnect and DnsQuery
$xml.SelectNodes("//NetworkConnect") | ForEach-Object { [void]$_.ParentNode.RemoveChild($_) }
$xml.SelectNodes("//DnsQuery") | ForEach-Object { [void]$_.ParentNode.RemoveChild($_) }

# Create a new RuleGroup
$ruleGroup = $xml.CreateElement("RuleGroup")
$ruleGroup.SetAttribute("name", "AggressiveNetwork")
$ruleGroup.SetAttribute("groupRelation", "or")

$netNode = $xml.CreateElement("NetworkConnect")
$netNode.SetAttribute("onmatch", "exclude")
$netNode.InnerXml = "<DestinationIp condition='is'>127.0.0.1</DestinationIp><SourceIp condition='is'>127.0.0.1</SourceIp><DestinationIp condition='begin with'>192.168.</DestinationIp><DestinationIp condition='begin with'>10.</DestinationIp>"
[void]$ruleGroup.AppendChild($netNode)

$dnsNode = $xml.CreateElement("DnsQuery")
$dnsNode.SetAttribute("onmatch", "exclude")
$dnsNode.InnerXml = "<QueryName condition='end with'>.arpa</QueryName><QueryName condition='end with'>.local</QueryName>"
[void]$ruleGroup.AppendChild($dnsNode)

[void]$xml.Sysmon.EventFiltering.AppendChild($ruleGroup)
$xml.Save("sysmon_tuned.xml")