Detect services configured to "Automatic" or "Automatic (Delayed Start)" (agents already detect services and states), expanding on this to combine alert capability when one of the applicable detected services state is "Stopped" or "Stopping" (i.e. not running).