Microsoft.Windows.HyperV.Compute
| Title | Sample | Rule |
|---|---|---|
| HcsServerCall | Y | N |
| HcsClientApi | Y | N |
| Operation_Run | Y | N |
| HcsOperation_Create | Y | N |
| Operation_ResultDocument | Y | N |
| HcsOperation_Close | Y | N |
| VirtualMachine_GetProperties | Y | N |
| ActivityIntermediateStop | Y | N |
HcsServerCall
#Fields #
| Name | Description |
|---|---|
apiName | |
operationId |
Example Event #
{
"system": {
"channel": "",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 0,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 2448,
"thread_id": 6400
},
"guid": "80CE50DE-D264-4581-950D-ABADEEE0D340",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft.Windows.HyperV.Compute",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 02:45:45.317Z",
"version": 0
},
"event_data": {
"apiName": "EnumerateSystems",
"operationId": 0
},
"message": ""
}
HcsClientApi
#Fields #
| Name | Description |
|---|---|
PartA_PrivTags | |
apiName | |
handle | |
wilActivity |
Example Event #
{
"system": {
"channel": "",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 0,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 2448,
"thread_id": 6400
},
"guid": "80CE50DE-D264-4581-950D-ABADEEE0D340",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft.Windows.HyperV.Compute",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 02:45:45.317Z",
"version": 0
},
"event_data": {
"PartA_PrivTags": 0,
"apiName": "HcsEnumerateComputeSystems",
"handle": "0000000000000000",
"wilActivity": "00190000"
},
"message": ""
}
Operation_Run
#Fields #
| Name | Description |
|---|---|
operationId | |
process | |
system | |
type |
Example Event #
{
"system": {
"channel": "",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 0,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 2448,
"thread_id": 6400
},
"guid": "80CE50DE-D264-4581-950D-ABADEEE0D340",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft.Windows.HyperV.Compute",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 02:45:45.317Z",
"version": 0
},
"event_data": {
"operationId": 0,
"process": "0000000000000000",
"system": "0000000000000000",
"type": -1
},
"message": ""
}
HcsOperation_Create
#Fields #
| Name | Description |
|---|---|
operation |
Example Event #
{
"system": {
"channel": "",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 0,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 2448,
"thread_id": 6400
},
"guid": "80CE50DE-D264-4581-950D-ABADEEE0D340",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft.Windows.HyperV.Compute",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 02:45:45.317Z",
"version": 0
},
"event_data": {
"operation": "90A9E75261020000"
},
"message": ""
}
Operation_ResultDocument
#Fields #
| Name | Description |
|---|---|
resultDocument |
Example Event #
{
"system": {
"channel": "",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 0,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 2448,
"thread_id": 6400
},
"guid": "80CE50DE-D264-4581-950D-ABADEEE0D340",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft.Windows.HyperV.Compute",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 02:45:45.318Z",
"version": 0
},
"event_data": {
"resultDocument": [
{
"Id": "608a9d28-4ef0-447e-a270-fc5a1cb6e1a0",
"SystemType": "VirtualMachine",
"RuntimeOsType": "Windows",
"Owner": "CmService",
"RuntimeId": "608a9d28-4ef0-447e-a270-fc5a1cb6e1a0",
"State": "SavedAsTemplate"
}
]
},
"message": ""
}
HcsOperation_Close
#Fields #
| Name | Description |
|---|---|
operation |
Example Event #
{
"system": {
"channel": "",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 0,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 2448,
"thread_id": 6400
},
"guid": "80CE50DE-D264-4581-950D-ABADEEE0D340",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft.Windows.HyperV.Compute",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 02:45:45.319Z",
"version": 0
},
"event_data": {
"operation": "90A9E75261020000"
},
"message": ""
}
VirtualMachine_GetProperties
#Fields #
| Name | Description |
|---|---|
PartA_PrivTags | |
computeSystemId | |
wilActivity |
Example Event #
{
"system": {
"channel": "",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 0,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 4076,
"thread_id": 4516
},
"guid": "80CE50DE-D264-4581-950D-ABADEEE0D340",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft.Windows.HyperV.Compute",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 02:45:45.318Z",
"version": 0
},
"event_data": {
"PartA_PrivTags": 0,
"computeSystemId": "608a9d28-4ef0-447e-a270-fc5a1cb6e1a0",
"wilActivity": "A4110000"
},
"message": ""
}
ActivityIntermediateStop
#Fields #
| Name | Description |
|---|---|
PartA_PrivTags | |
wilActivity |
Example Event #
{
"system": {
"channel": "",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 0,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 4076,
"thread_id": 4516
},
"guid": "80CE50DE-D264-4581-950D-ABADEEE0D340",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft.Windows.HyperV.Compute",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 02:45:45.318Z",
"version": 0
},
"event_data": {
"PartA_PrivTags": 16777216,
"wilActivity": "\u0000\u0000\u0000\u0000\u0011"
},
"message": ""
}