packages/windows/sysmon_operational: add sysmon event 26 handler

[efd6]

What does this PR do?

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

First and third commits are mechanical, second and fourth are semantic.

How to test this PR locally

elastic-package test in the windows package directory.

Related issues

• Relates x-pack/winlogbeat/module/sysmon: add eventid 26 handler beats#29957
• Relates [Winlogbeat] Update Sysmon module for Schema 4.70 that includes Event ID 26 beats#26280

Screenshots

Test event 1:

Test event 2:

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-01-27T06:44:48.377+0000

• Duration: 19 min 3 sec

• Commit: 5a7d28f

Test stats 🧪

Test	Results
Failed	0
Passed	126
Skipped	0
Total	126

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[marc-gr]

I think the same change needs to be done in packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/sysmon_operational.yml

[efd6]

PTAL