Microsoft-Windows-Direct3D10_1

18 events across 1 channel

Event	Title	Channel
1	Name	Analytic
2	NameDCStart	Analytic
3	DeviceStart	Analytic
4	DeviceStop	Analytic
5	DeviceDCStart	Analytic
6	BufferStart	Analytic
7	BufferStop	Analytic
8	BufferDCStart	Analytic
9	Texture1DStart	Analytic
10	Texture1DStop	Analytic
11	Texture1DDCStart	Analytic
12	Texture2DStart	Analytic
13	Texture2DStop	Analytic
14	Texture2DDCStart	Analytic
15	Texture3DStart	Analytic
16	Texture3DStop	Analytic
17	Texture3DDCStart	Analytic
18	Texture2D	Analytic

Event ID 1: Name

Provider: Microsoft-Windows-Direct3D10_1
Channel: Analytic
Task: Name

Fields #

Name	Description
`pObject` Pointer
`CchOldDebugObjectName` UInt32
`OldDebugObjectName` AnsiString
`CchNewDebugObjectName` UInt32
`NewDebugObjectName` AnsiString

Event ID 2: NameDCStart

Provider: Microsoft-Windows-Direct3D10_1
Channel: Analytic
Task: Name
Opcode: DC_Start

Fields #

Name	Description
`pObject` Pointer
`CchDebugObjectName` UInt32
`DebugObjectName` AnsiString

Event ID 3: DeviceStart

Provider: Microsoft-Windows-Direct3D10_1
Channel: Analytic
Task: Device
Opcode: Start

Fields #

Name	Description
`pID3D10_1Device` Pointer
`pIDXGIDevice` Pointer
`pIDXGIAdapter` Pointer
`CreationFlags` UInt32
`FeatureLevel` UInt32
`hKMAdapter` UInt32
`hUMAdapter` Pointer
`UMAdapterVersion` UInt64
`hKMDevice` UInt32
`hUMDevice` Pointer
`UMDeviceVersion` UInt64
`UMDeviceFlags` UInt32

Event ID 4: DeviceStop

Provider: Microsoft-Windows-Direct3D10_1
Channel: Analytic
Task: Device
Opcode: Stop

Fields #

Name	Description
`pID3D10_1Device` Pointer
`pIDXGIDevice` Pointer
`pIDXGIAdapter` Pointer
`CreationFlags` UInt32
`FeatureLevel` UInt32
`hKMAdapter` UInt32
`hUMAdapter` Pointer
`UMAdapterVersion` UInt64
`hKMDevice` UInt32
`hUMDevice` Pointer
`UMDeviceVersion` UInt64
`UMDeviceFlags` UInt32

Event ID 5: DeviceDCStart

Provider: Microsoft-Windows-Direct3D10_1
Channel: Analytic
Task: Device
Opcode: DC_Start

Fields #

Name	Description
`pID3D10_1Device` Pointer
`pIDXGIDevice` Pointer
`pIDXGIAdapter` Pointer
`CreationFlags` UInt32
`FeatureLevel` UInt32
`hKMAdapter` UInt32
`hUMAdapter` Pointer
`UMAdapterVersion` UInt64
`hKMDevice` UInt32
`hUMDevice` Pointer
`UMDeviceVersion` UInt64
`UMDeviceFlags` UInt32

Event ID 6: BufferStart

Provider: Microsoft-Windows-Direct3D10_1
Channel: Analytic
Task: Buffer
Opcode: Start

Fields #

Name	Description
`pID3D10Resource` Pointer
`pIDXGISurface` Pointer
`pID3D10_1Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 7: BufferStop

Provider: Microsoft-Windows-Direct3D10_1
Channel: Analytic
Task: Buffer
Opcode: Stop

Fields #

Name	Description
`pID3D10Resource` Pointer
`pIDXGISurface` Pointer
`pID3D10_1Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 8: BufferDCStart

Provider: Microsoft-Windows-Direct3D10_1
Channel: Analytic
Task: Buffer
Opcode: DC_Start

Fields #

Name	Description
`pID3D10Resource` Pointer
`pIDXGISurface` Pointer
`pID3D10_1Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 9: Texture1DStart

Provider: Microsoft-Windows-Direct3D10_1
Channel: Analytic
Task: Texture1D
Opcode: Start

Fields #

Name	Description
`pID3D10Resource` Pointer
`pIDXGISurface` Pointer
`pID3D10_1Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 10: Texture1DStop

Provider: Microsoft-Windows-Direct3D10_1
Channel: Analytic
Task: Texture1D
Opcode: Stop

Fields #

Name	Description
`pID3D10Resource` Pointer
`pIDXGISurface` Pointer
`pID3D10_1Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 11: Texture1DDCStart

Provider: Microsoft-Windows-Direct3D10_1
Channel: Analytic
Task: Texture1D
Opcode: DC_Start

Fields #

Name	Description
`pID3D10Resource` Pointer
`pIDXGISurface` Pointer
`pID3D10_1Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 12: Texture2DStart

Provider: Microsoft-Windows-Direct3D10_1
Channel: Analytic
Task: Texture2D
Opcode: Start

Fields #

Name	Description
`pID3D10Resource` Pointer
`pIDXGISurface` Pointer
`pID3D10_1Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 13: Texture2DStop

Provider: Microsoft-Windows-Direct3D10_1
Channel: Analytic
Task: Texture2D
Opcode: Stop

Fields #

Name	Description
`pID3D10Resource` Pointer
`pIDXGISurface` Pointer
`pID3D10_1Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 14: Texture2DDCStart

Provider: Microsoft-Windows-Direct3D10_1
Channel: Analytic
Task: Texture2D
Opcode: DC_Start

Fields #

Name	Description
`pID3D10Resource` Pointer
`pIDXGISurface` Pointer
`pID3D10_1Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 15: Texture3DStart

Provider: Microsoft-Windows-Direct3D10_1
Channel: Analytic
Task: Texture3D
Opcode: Start

Fields #

Name	Description
`pID3D10Resource` Pointer
`pIDXGISurface` Pointer
`pID3D10_1Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 16: Texture3DStop

Provider: Microsoft-Windows-Direct3D10_1
Channel: Analytic
Task: Texture3D
Opcode: Stop

Fields #

Name	Description
`pID3D10Resource` Pointer
`pIDXGISurface` Pointer
`pID3D10_1Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 17: Texture3DDCStart

Provider: Microsoft-Windows-Direct3D10_1
Channel: Analytic
Task: Texture3D
Opcode: DC_Start

Fields #

Name	Description
`pID3D10Resource` Pointer
`pIDXGISurface` Pointer
`pID3D10_1Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 18: Texture2D

Provider: Microsoft-Windows-Direct3D10_1
Channel: Analytic
Task: Texture2D

Fields #

Name	Description
`Resources` UInt32
`pIDXGISurfaces` Pointer
`hNewKMResources` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 9b7e4c8f-342c-4106-a19f-4f2704f689f0

Defined in d3d10_1core.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1882 · captured 2026-06-02

Downloads

Microsoft-Windows-Direct3D10_1 registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-Direct3D10_1 registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)