Windows Service Events

[k2niner]

Windows Service activity doesn't cleanly map. May need to add a class to Windows Profile or modify Process Activity [1007].

From OMB M-21-31 (for Windows Logging):

• Service Status Changes (Start, Stop, Fail, Restart, etc.)
• Service Failures and Restarts
• Process Creation and Termination

[mikeradka]

Following thorough deliberation in recent System Activity meetings, we've concluded that the current class set is insufficient for capturing Windows Service events.

Our proposed action is to draft a pull request (PR) to integrate a dedicated Windows Service Events class into the Windows Extension.

[mikeradka]

Note: we could also look into windows service modifications