[Windows]: Missing Important Parsing for Hyper-V

### Integration Name

Windows [windows]

### Dataset Name

windows.hyper_v.vmms, windows.hyper_v.worker

### Integration Version

3.2.3

### Agent Version

8.18.4

### OS Version and Architecture

Windows Server

### User Goal

Windows Hyper-V Hosts do not natively parse the VMMS events which show VM activity such as Power ON, OFF, VM Creation, VM Deletion etc. This type of activity is important for several security use cases. There are also other examples of why VM activity needs to be monitored. See [https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign](https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign) as an example but with VMware running as the VM host.

User Goal:
1. A native integration for Hyper-V should be created so that tis integration can be supported and properly parse these events.
1. Collect and Parse all Microsoft-Windows-Hyper-V-VMMS-Admin events which equate to Management actions (Creation, Deletion, Configuration changes) along with Microsoft-Windows-Hyper-V-Worker-Admin events which equate to Execution states (Power On, Power Off, Saved State).
1. Both the VM Host (the device running the VM) and the VM Name need to be broken out into individual fields so that this activity can be tracked and alerted on.
1. Both of these names should also be populated into the `related.hosts` field for better searching and functionality

### Existing Features

Hyper-V VM State events are not natively collector or parsed. Custom collection and parsers have to be created and maintained for this functionality currently.

The following Windows Channel Names should have the events collected natively in a supported fashion:
1. Microsoft-Windows-Hyper-V-VMMS-Admin
1. Microsoft-Windows-Hyper-V-Worker-Admin

### What did you see?

The following Windows Channels are not collector or parsed nativly:
1. Microsoft-Windows-Hyper-V-VMMS-Admin
1. Microsoft-Windows-Hyper-V-Worker-Admin

Below are some example events. **Not a complete list**
`


13002
0
4
0
0
0x8000000000000000

1501


Microsoft-Windows-Hyper-V-VMMS-Admin
HYPERV-HOST.domain.local




MyNewVM
C8F1E3D2-9A4B-4C5D-8E7F-1A2B3C4D5E6F
C:\ProgramData\Microsoft\Windows\Hyper-V\Virtual Machines\C8F1E3D2-9A4B-4C5D-8E7F-1A2B3C4D5E6F.xml


`

`


13003
0
4
0
0
0x8000000000000000

1505
Microsoft-Windows-Hyper-V-VMMS-Admin
HYPERV-HOST.domain.local




MyOldVM
A1B2C3D4-E5F6-7890-1234-567890ABCDEF


`

`


18500
0
4
0
0
0x8000000000000000

800
Microsoft-Windows-Hyper-V-Worker-Admin
HYPERV-HOST.domain.local



MyNewVM
C8F1E3D2-9A4B-4C5D-8E7F-1A2B3C4D5E6F

`

`


18504
0
4
0
0
0x8000000000000000

805
Microsoft-Windows-Hyper-V-Worker-Admin
HYPERV-HOST.domain.local



MyNewVM
C8F1E3D2-9A4B-4C5D-8E7F-1A2B3C4D5E6F

`

### Anything else?

Below are a few examples of the event IDs and Types that should be parsed. **This is not necessarily a complete list**

Event | Event ID | Log Source | Description
-- | -- | -- | --
VM Created | 10000 | Hyper-V-VMMS | "The virtual machine 'VMName' was created." (Often followed by 10002 for setting config).
VM Deleted | 10030 | Hyper-V-VMMS | "The virtual machine 'VMName' was deleted."
Settings Changed | 10002 | Hyper-V-VMMS | "The virtual machine 'VMName' configuration was successfully changed."
VM Powered ON | 18500 | Hyper-V-Worker | "'VMName' started successfully."
VM Powered OFF | 18502 | Hyper-V-Worker | "'VMName' was turned off successfully." (Hard Turn Off)
VM Shutdown | 18504 | Hyper-V-Worker | "'VMName' was shut down successfully." (Graceful Guest Shutdown)
VM Saved | 18510 | Hyper-V-Worker | "'VMName' was saved successfully." (Saved State)
VM Resumed | 18596 | Hyper-V-Worker | "'VMName' was resumed successfully." (From Saved State)
Failed Start | 15130 | Hyper-V-VMMS | "'VMName' failed to start."
Failed Start | 12010 | Hyper-V-Worker | Error causing the worker process (VM) to fail startup.