Having sysmon installed on a client computer (in my case the most recent Windows 10), and having defined event rules for Event ID 15 (FileCreateStreamHash) on the client computer, I found that any download triggers an Event 15 if the download folder is "local" (on a locally attached drive), for example somehow on %systemdrive%, which is what I expected. So, sysmon works.
However, if the download folder resides on a network mapped drive, no Event 15 is logged, at least not on the client computer. For example, if you map Z: on the client computer to \\some-fileserver\some-share, then no download will trigger any Event 15 on the client computer if the download is stored in Z:\download.
On the other hand, a sysmon installed on the file server WILL trigger event 15 in that case, but unfortunately is missing valuable information. For example the process id in that event 15 is not the pid of the browser instance on the client, but the file server service instance, the "image" does not identify the browser, it is SYSTEM.
Q: I assume this behaviour is "works as designed"?