Some endpoints may require Microsoft Security Advisory to be installed as described in the Microsoft Knowledge base article KB3004375 (typically only required for versions of Windows prior to Windows 8.1 or server 2012 R2). To enable command-line monitoring, you enable a group of policy setting.
To change the setting:
Launch the local group policy editor (gpedit.msc) and navigate to Computer Configuration > Administrative Templates > System > Audit Process reaction.
From the right pane, click the Policy Setting link for the Include command line in process creation events setting.
In the dialog box, select the Enabled option and then click Apply to apply the changes to the system.
For additional information, see the Microsoft documentation here.