Microsoft-Windows-FMS

17 events across 2 channels

Event	Title	Channel
1000	FMS DLL initialization failed	System
2015	FMS API entry for: ApiName.	Analytic
2016	FMS API exit for: ApiName.	Analytic
30000	PerfTrack_DisplayFmsInitStart	Analytic
30001	PerfTrack_DisplayFmsInitStop	Analytic
40000	FMS ETW.	Analytic
40001	FMS ETW.	Analytic
40002	FMS ETW.	Analytic
40003	FMS ETW.	Analytic
40004	FMS ETW.	Analytic
40005	FMS ETW.	Analytic
40006	FMS ETW.	Analytic
40007	FMS ETW.	Analytic
40008	FMS ETW.	Analytic
40009	FMS ETW.	Analytic
40010	FMS ETW.	Analytic
40011	FMS ETW.	Analytic

Event ID 1000: FMS DLL initialization failed

Provider: Microsoft-Windows-FMS
Channel: System
Task: FMSDLLinitialization
Opcode: Start

Description

FMS DLL initialization failed.

Message #

FMS DLL initialization failed

Event ID 2015: FMS API entry for: ApiName.

Provider: Microsoft-Windows-FMS
Channel: Analytic
Task: FMSAPIentrycall

Description

FMS API entry for: ApiName.

Message #

FMS API entry for: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 2016: FMS API exit for: ApiName.

Provider: Microsoft-Windows-FMS
Channel: Analytic
Task: FMSAPIexitcall

Description

FMS API exit for: ApiName.

Message #

FMS API exit for: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 30000: PerfTrack_DisplayFmsInitStart

Provider: Microsoft-Windows-FMS
Channel: Analytic
Task: PerfTrack_DisplayFmsInit
Opcode: Start

Event ID 30001: PerfTrack_DisplayFmsInitStop

Provider: Microsoft-Windows-FMS
Channel: Analytic
Task: PerfTrack_DisplayFmsInit
Opcode: Stop

Event ID 40000: FMS ETW.

Provider: Microsoft-Windows-FMS
Channel: Analytic
Task: ETWDebugMsg
Opcode: NameResolution

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40001: FMS ETW.

Provider: Microsoft-Windows-FMS
Channel: Analytic
Task: ETWDebugMsg
Opcode: GetFontNameTableStart

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40002: FMS ETW.

Provider: Microsoft-Windows-FMS
Channel: Analytic
Task: ETWDebugMsg
Opcode: GetFontNameTableStop

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40003: FMS ETW.

Provider: Microsoft-Windows-FMS
Channel: Analytic
Task: ETWDebugMsg
Opcode: GetNameRecordStart

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40004: FMS ETW.

Provider: Microsoft-Windows-FMS
Channel: Analytic
Task: ETWDebugMsg
Opcode: GetNameRecordStop

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40005: FMS ETW.

Provider: Microsoft-Windows-FMS
Channel: Analytic
Task: ETWDebugMsg
Opcode: GetNameStringsStart

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40006: FMS ETW.

Provider: Microsoft-Windows-FMS
Channel: Analytic
Task: ETWDebugMsg
Opcode: GetNameStringsStop

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40007: FMS ETW.

Provider: Microsoft-Windows-FMS
Channel: Analytic
Task: ETWDebugMsg
Opcode: GetFontDataStart

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40008: FMS ETW.

Provider: Microsoft-Windows-FMS
Channel: Analytic
Task: ETWDebugMsg
Opcode: GetFontDataStop

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40009: FMS ETW.

Provider: Microsoft-Windows-FMS
Channel: Analytic
Task: ETWDebugMsg
Opcode: GdiGetFontRealizationInfoStart

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40010: FMS ETW.

Provider: Microsoft-Windows-FMS
Channel: Analytic
Task: ETWDebugMsg
Opcode: GdiGetFontRealizationInfoStop

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40011: FMS ETW.

Provider: Microsoft-Windows-FMS
Channel: Analytic
Task: ETWDebugMsg
Opcode: FmsErrorMessage

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID dea07764-0790-44de-b9c4-49677b17174f

Defined in fms.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Microsoft-Windows-FMS registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-FMS registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)