| Microsoft-Windows-Hyper-V-VMMS-Admin | 14000 | Info | Hyper-V Virtual Machine Management Service started |
| Microsoft-Windows-Hyper-V-VMMS-Admin | 14001 | High | VMMS stopped unexpectedly |
| Microsoft-Windows-Hyper-V-VMMS-Admin | 14010 | Critical | VMMS initialization failed |
| System | 1000 | High | Host restarted unexpectedly (hypervisor failure) |
| System | 16400 | Info | Hyper-V hypervisor launched successfully |
| Microsoft-Windows-Hyper-V-Worker-Admin | 18500 | Info | Virtual machine created |
| Microsoft-Windows-Hyper-V-Worker-Admin | 18501 | Medium | Virtual machine deleted |
| Microsoft-Windows-Hyper-V-Worker-Admin | 18510 | Info | Virtual machine started |
| Microsoft-Windows-Hyper-V-Worker-Admin | 18511 | Info | Virtual machine stopped or turned off |
| Microsoft-Windows-Hyper-V-Worker-Admin | 18514 | Info | Virtual machine paused or saved |
| Microsoft-Windows-Hyper-V-Worker-Admin | 18520 | Medium | Snapshot (checkpoint) created |
| Microsoft-Windows-Hyper-V-Worker-Admin | 18521 | Info | Snapshot deleted or applied |
| Microsoft-Windows-Hyper-V-Worker-Admin | 18550 | Medium | VM CPU usage exceeded threshold |
| Microsoft-Windows-Hyper-V-Worker-Admin | 18551 | High | VM memory pressure detected |
| Microsoft-Windows-Hyper-V-Worker-Admin | 18552 | High | Storage latency affecting VM performance |
| Microsoft-Windows-Hyper-V-Storage-Channels | 29210 | High | Virtual hard disk I/O error |
| Microsoft-Windows-Hyper-V-Storage-Channels | 29212 | Info | VHD(X) attached successfully |
| Microsoft-Windows-Hyper-V-VMSP | 10051 | Info | Virtual switch created |
| Microsoft-Windows-Hyper-V-VMSP | 10052 | Medium | Virtual switch deleted |
| Microsoft-Windows-Hyper-V-VMSP | 10055 | Medium | Port ACL modified |
| Microsoft-Windows-Hyper-V-VMSP | 10060 | High | Network adapter disconnected from switch |
| Microsoft-Windows-Hyper-V-VMSP | 10062 | Critical | MAC spoofing or port security violation detected |
| Microsoft-Windows-Hyper-V-Replica-Admin | 32000 | Info | Replication started successfully |
| Microsoft-Windows-Hyper-V-Replica-Admin | 32004 | High | Replication failed |
| Microsoft-Windows-Hyper-V-Replica-Admin | 32006 | Info | Initial replication completed |
| Microsoft-Windows-Hyper-V-Replica-Admin | 32010 | High | Replication connection lost |
| Microsoft-Windows-Hyper-V-Replica-Admin | 32014 | Info | Replication paused manually |
| Microsoft-Windows-Hyper-V-Integration | 4096 | Info | Integration service started |
| Microsoft-Windows-Hyper-V-Integration | 4097 | High | Heartbeat stopped responding |
| Microsoft-Windows-Hyper-V-Integration | 4098 | Medium | Time synchronization failed |
| Microsoft-Windows-Hyper-V-Integration | 4100 | Info | Shutdown command from host accepted |
| Security | 4624 | Info | Successful logon to Hyper-V host |
| Security | 4625 | High | Failed login to Hyper-V management interface |
| Security | 4672 | Medium | Admin-level privileges assigned |
| Microsoft-Windows-Hyper-V-VMMS-Admin | 16010 | High | Unauthorized attempt to modify VM configuration |
| Microsoft-Windows-Hyper-V-VMSP | 10062 | Critical | Port security or MAC spoofing violation |
| Hyper-V-Worker/Admin | 14050 | Critical | VM failed to start |
| Hyper-V-Worker/Admin | 14080 | High | VM integration service failed |
| Hyper-V-VMMS/Admin | 16010 | High | Hyper-V management service stopped unexpectedly |
| Hyper-V-VMMS/Admin | 18012 | Medium | Snapshot creation failed |
| Hyper-V-Hypervisor | 6 | Critical | Processor initialization failed |
| Hyper-V-Networking | 11302 | High | Virtual switch configuration failed |
| Hyper-V-Storage | 32022 | Critical | Disk I/O failure on virtual disk |