[VMware vSphere]: Incorrect and Missing Parsing

### Integration Name

VMware vSphere [vsphere]

### Dataset Name

vsphere.log

### Integration Version

1.22.0

### Agent Version

8.18.4

### OS Version and Architecture

22.04.3 LTS (Jammy Jellyfish)

### User Goal

There are issues with parsing important Authentication events. Also, Virtual Machine Activity (VM Creation, Deletion, Power On, Power Off, Suspend etc.) is completely omitted from any useful parsing. These are important events for several security use cases. See [https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign](https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign) as one example.

### User Goal:
1. Properly parse all Authentication events to the various authentication methods, SSO, SSH, Web UI etc from VMware vSphere, VMware vCenter and VMware ESXi syslog events sent to Elastic and include if these were successful or not along with the reason for any failure.
1. Parse all VM actions such as (VM Creation, Deletion, Power On, Power Off, Suspend etc.). These are important as there are reports of malicious ransomware actors breaking into environments shutting down all VMs on a host(s) and then creating a new VM to use to encrypt the rest of the VM hosts data.
1. Both the VM Host (the device running the VM) and the VM Name need to be broken out into individual fields so that this activity can be tracked and alerted on.
1. Both of these names should also be populated into the `related.hosts` field for better searching and functionality

### Existing Features

1. The logs-vsphere.log-1.22.0-login pipeline does not adequately parse login events from VMware vCenter, vSphere or ESXi.
1. There is no current pipeline for VirtualMachine Activity (VM Creation, Deletion, Power On, Power Off, Suspend etc.)

### What did you see?

1. Events for `Cannot login user WEB_DOOR\@: ` does not have any parsed event.outcome values (which would show if the login was a success failure) and does not have event.reason that shows why the failure occurred (example. no permission)
1. Events for `Privilege check failed for user WEB_DOOR\ for ` does not parse out the username that was the cause of the event nor the event.reason or event.outcome

1. VPXD Events such as `<14>1 2023-10-27T08:30:15.456Z vcenter-01.local vpxd - - Event 1021 : Created virtual machine Windows-Server-2022 on host esxi-01.local in datacenter DC-01.
[EventType: VmCreatedEvent] [User: DOMAIN\AdminUser] [VM: Windows-Server-2022]` or `<14>1 2023-10-27T09:15:22.789Z vcenter-01.local vpxd - - Event 1045 : Removed virtual machine Windows-Server-Old on host esxi-01.local from datacenter DC-01.
[EventType: VmRemovedEvent] [User: DOMAIN\AdminUser]' OR `<14>1 2023-10-27T10:05:01.112Z vcenter-01.local vpxd - - Event 2011 : Windows-Server-2022 on host esxi-01.local in datacenter DC-01 is powered on.
[EventType: VmPoweredOnEvent] [User: DOMAIN\AppUser]` need to be parsed and have the VM machine name broken out as well for searching by a VM hostname.
1. These are not the only events that need to be parsed. See vCenter vpxd events for the various permutations of the VM state messages.
1. HOSTD Event such as `2023-10-27T10:05:01.112Z esxi-01.local Hostd: info hostd[209933] [Originator@6876 sub=Vimsvc.ha-eventmgr] Event 155 : Windows-Server-2022 on esxi-01.local in ha-datacenter is powered on` OR `2023-10-27T10:10:45.334Z esxi-01.local Hostd: info hostd[209933] [Originator@6876 sub=Vimsvc.ha-eventmgr] Event 158 : Windows-Server-2022 on esxi-01.local in ha-datacenter is powered off.` need to be parsed and have the VM machine name broken out as well for searching by a VM hostname.
1. These are not the only events that need to be parsed. See the ESXi hostd events for the various permutations of the VM state message.

### Anything else?

[https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign](https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign)