Microsoft-Windows-Battery

36 events across 1 channel

Event	Title	Channel
1	SystemBatteryStatusChange	Diagnostic
2	SystemBatteryStatusRundown	Diagnostic
3	BatteryBayRundown	Diagnostic
4	BixUpdated	Diagnostic
5	BixRundown	Diagnostic
6	BifUpdated	Diagnostic
7	BifRundown	Diagnostic
8	BstUpdated	Diagnostic
9	BstRundown	Diagnostic
10	BtpSet	Diagnostic
11	BtpRundown	Diagnostic
12	AcpiNotify	Diagnostic
13	BatteryPercentRemaining	Diagnostic
14	BatteryChargingWatchdogUpdated	Diagnostic
15	BatteryChargingWatchdogRundown	Diagnostic
16	BptSet	Diagnostic
17	BptRundown	Diagnostic
18	BpsGet	Diagnostic
19	BpsRundown	Diagnostic
20	PsrGet	Diagnostic
21	PsrRundown	Diagnostic
22	PifGet	Diagnostic
23	PifRundown	Diagnostic
24	RecCapabilities	Diagnostic
25	RecCapabilitiesRundown	Diagnostic
26	RecSupported	Diagnostic
27	RecSupportedRundown	Diagnostic
28	RecStatus	Diagnostic
29	RecStatusRundown	Diagnostic
30	RecOverride	Diagnostic
31	RecOverrideRundown	Diagnostic
32	RecWattage	Diagnostic
33	RecWattageRundown	Diagnostic
34	RecWattage34	Diagnostic
35	RecWattageRundown35	Diagnostic
36	AdapterAdd	Diagnostic

Event ID 1: SystemBatteryStatusChange

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: SystemBatteryStatusChange

Fields #

Name	Description
`BatteryPresent` Boolean
`PowerState` UInt32
`Capacity` UInt32
`BatteryPercent` UInt32
`ChargeRate` Int32
`InstantaneousPeakPower` UInt32
`InstantaneousPeakPeriod` UInt32
`SustainablePeakPower` UInt32
`SustainablePeakPeriod` UInt32
`AdapterPeakPower` UInt32
`AdapterMaxOutputPower` UInt32
`AdapterMaxInputPower` UInt32

Event ID 2: SystemBatteryStatusRundown

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: SystemBatteryStatusRundown

Fields #

Name	Description
`BatteryPresent` Boolean
`PowerState` UInt32
`Capacity` UInt32
`BatteryPercent` UInt32
`ChargeRate` Int32
`InstantaneousPeakPower` UInt32
`InstantaneousPeakPeriod` UInt32
`SustainablePeakPower` UInt32
`SustainablePeakPeriod` UInt32
`AdapterPeakPower` UInt32
`AdapterMaxOutputPower` UInt32
`AdapterMaxInputPower` UInt32

Event ID 3: BatteryBayRundown

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: BatteryBayRundown

Fields #

Name	Description
`Handle` Pointer
`BatteryPresent` Boolean

Event ID 4: BixUpdated

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: BixUpdated

Fields #

Name	Description
`Handle` Pointer
`Revision` UInt32
`PowerUnit` UInt32
`DesignCapacity` UInt32
`LastFullChargeCapacity` UInt32
`BatteryTechnology` UInt32
`DesignVoltage` UInt32
`WarningDesignCapacity` UInt32
`LowDesignCapacity` UInt32
`CapacityGranularity1` UInt32
`CapacityGranularity2` UInt32
`CycleCount` UInt32
`MeasurementAccuracy` UInt32
`MaxSamplingTime` UInt32
`MinSamplingTIme` UInt32
`MaxAveragingInterval` UInt32
`MinAveragingInterval` UInt32
`ModelNumber` AnsiString
`SerialNumber` AnsiString
`BatteryType` AnsiString
`OemInformation` AnsiString

Event ID 5: BixRundown

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: BixRundown

Fields #

Name	Description
`Handle` Pointer
`Revision` UInt32
`PowerUnit` UInt32
`DesignCapacity` UInt32
`LastFullChargeCapacity` UInt32
`BatteryTechnology` UInt32
`DesignVoltage` UInt32
`WarningDesignCapacity` UInt32
`LowDesignCapacity` UInt32
`CapacityGranularity1` UInt32
`CapacityGranularity2` UInt32
`CycleCount` UInt32
`MeasurementAccuracy` UInt32
`MaxSamplingTime` UInt32
`MinSamplingTIme` UInt32
`MaxAveragingInterval` UInt32
`MinAveragingInterval` UInt32
`ModelNumber` AnsiString
`SerialNumber` AnsiString
`BatteryType` AnsiString
`OemInformation` AnsiString

Event ID 6: BifUpdated

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: BifUpdated

Fields #

Name	Description
`Handle` Pointer
`PowerUnit` UInt32
`DesignCapacity` UInt32
`LastFullChargeCapacity` UInt32
`BatteryTechnology` UInt32
`DesignVoltage` UInt32
`WarningDesignCapacity` UInt32
`LowDesignCapacity` UInt32
`CapacityGranularity1` UInt32
`CapacityGranularity2` UInt32
`ModelNumber` AnsiString
`SerialNumber` AnsiString
`BatteryType` AnsiString
`OemInformation` AnsiString

Event ID 7: BifRundown

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: BifRundown

Fields #

Name	Description
`Handle` Pointer
`PowerUnit` UInt32
`DesignCapacity` UInt32
`LastFullChargeCapacity` UInt32
`BatteryTechnology` UInt32
`DesignVoltage` UInt32
`WarningDesignCapacity` UInt32
`LowDesignCapacity` UInt32
`CapacityGranularity1` UInt32
`CapacityGranularity2` UInt32
`ModelNumber` AnsiString
`SerialNumber` AnsiString
`BatteryType` AnsiString
`OemInformation` AnsiString

Event ID 8: BstUpdated

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: BstUpdated

Fields #

Name	Description
`Handle` Pointer
`State` UInt32
`PresentRate` UInt32
`RemainingCapacity` UInt32
`PresentVoltage` UInt32

Event ID 9: BstRundown

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: BstRundown

Fields #

Name	Description
`Handle` Pointer
`State` UInt32
`PresentRate` UInt32
`RemainingCapacity` UInt32
`PresentVoltage` UInt32

Event ID 10: BtpSet

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: BtpSet

Fields #

Name	Description
`Handle` Pointer
`TripPoint` UInt32

Event ID 11: BtpRundown

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: BtpRundown

Fields #

Name	Description
`Handle` Pointer
`TripPoint` UInt32

Event ID 12: AcpiNotify

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: AcpiNotify

Fields #

Name	Description
`Handle` Pointer
`Notification` UInt32

Event ID 13: BatteryPercentRemaining

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: BatteryPercentRemaining

Fields #

Name	Description
`RemainingPercentage` UInt32
`PercentageChange` Int32
`AcDc` UInt32
`ElapsedTimeMs` UInt32

Event ID 14: BatteryChargingWatchdogUpdated

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: BatteryChargingWatchdogUpdated

Fields #

Name	Description
`Handle` Pointer
`BatteryState` UInt32
`WatchdogState` UInt32
`WatchdogTimeout` UInt32

Event ID 15: BatteryChargingWatchdogRundown

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: BatteryChargingWatchdogRundown

Fields #

Name	Description
`Handle` Pointer
`BatteryState` UInt32
`WatchdogState` UInt32
`WatchdogTimeout` UInt32

Event ID 16: BptSet

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: BptSet

Fields #

Name	Description
`Type` UInt32
`Value` UInt32
`Status` UInt32	NTSTATUS reference
`ReturnValue` UInt32
`Failure` UInt32

Event ID 17: BptRundown

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: BptRundown

Fields #

Name	Description
`Type` UInt32
`Value` UInt32
`Status` UInt32	NTSTATUS reference
`ReturnValue` UInt32
`Failure` UInt32

Event ID 18: BpsGet

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: BpsGet

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`InstantaneousPeakPower` UInt32
`InstantaneousPeakPeriod` UInt32
`SustainablePeakPower` UInt32
`SustainablePeakPeriod` UInt32
`Failure` UInt32

Event ID 19: BpsRundown

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: BpsRundown

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`InstantaneousPeakPower` UInt32
`InstantaneousPeakPeriod` UInt32
`SustainablePeakPower` UInt32
`SustainablePeakPeriod` UInt32
`Failure` UInt32

Event ID 20: PsrGet

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: PsrGet

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`ReturnStatus` UInt32

Event ID 21: PsrRundown

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: PsrRundown

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`ReturnStatus` UInt32

Event ID 22: PifGet

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: PifGet

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`MaxOutputPower` UInt32
`MaxInputPower` UInt32
`Failure` UInt32

Event ID 23: PifRundown

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: PifRundown

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`MaxOutputPower` UInt32
`MaxInputPower` UInt32
`Failure` UInt32
`ModelNumber` AnsiString
`SerialNumber` AnsiString
`OemInformation` AnsiString

Event ID 24: RecCapabilities

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: RecCapabilities

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`RecSupportedFunctions` UInt32
`Failure` UInt32

Event ID 25: RecCapabilitiesRundown

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: RecCapabilitiesRundown

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`RecSupportedFunctions` UInt32
`Failure` UInt32

Event ID 26: RecSupported

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: RecSupported

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`RecSupported` Boolean
`Failure` UInt32

Event ID 27: RecSupportedRundown

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: RecSupportedRundown

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`RecSupported` Boolean
`Failure` UInt32

Event ID 28: RecStatus

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: RecStatus

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`RecEngaged` Boolean
`RecStartTime` UInt64
`RecEndTime` UInt64
`RecOverriden` Boolean
`Failure` UInt32

Event ID 29: RecStatusRundown

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: RecStatusRundown

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`RecEngaged` Boolean
`RecStartTime` UInt64
`RecEndTime` UInt64
`RecOverriden` Boolean
`Failure` UInt32

Event ID 30: RecOverride

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: RecOverride

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`RecOverride` Boolean
`OverrideValue` Boolean
`Failure` UInt32

Event ID 31: RecOverrideRundown

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: RecOverrideRundown

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`RecOverride` Boolean
`Failure` UInt32

Event ID 32: RecWattage

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: RecWattage

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`AdapterType` UInt32
`MinimumPower` UInt32
`NominalPower` UInt32
`MaximumPower` UInt32
`Failure` UInt32

Event ID 33: RecWattageRundown

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: RecWattageRundown

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`AdapterType` UInt32
`MinimumPower` UInt32
`NominalPower` UInt32
`MaximumPower` UInt32
`Failure` UInt32

Event ID 34: RecWattage34

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: RecWattage

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`AdapterType1` UInt32
`MinimumPower1` UInt32
`NominalPower1` UInt32
`MaximumPower1` UInt32
`AdapterType2` UInt32
`MinimumPower2` UInt32
`NominalPower2` UInt32
`MaximumPower2` UInt32
`Failure` UInt32

Event ID 35: RecWattageRundown35

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: RecWattageRundown

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`AdapterType1` UInt32
`MinimumPower1` UInt32
`NominalPower1` UInt32
`MaximumPower1` UInt32
`AdapterType2` UInt32
`MinimumPower2` UInt32
`NominalPower2` UInt32
`MaximumPower2` UInt32
`Failure` UInt32

Event ID 36: AdapterAdd

Provider: Microsoft-Windows-Battery
Channel: Diagnostic
Task: AdapterAdd

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`Failure` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 59819d0a-adaf-46b2-8d7c-990bc39c7c15

Defined in microsoft-windows-battery-events.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.3624 · captured 2026-06-02

Downloads

Microsoft-Windows-Battery registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-Battery registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)