detection.wiki

Microsoft-Windows-FunctionDiscovery

58 events across 1 channel

Event IDTitleChannel
1000Begin IFunctionDiscovery::GetInstanceCollection().Analytic
1001End IFunctionDiscovery::GetInstanceCollection().Analytic
1002Begin IFunctionDiscovery::GetInstance().Analytic
1003End IFunctionDiscovery::GetInstance().Analytic
1004Begin IFunctionDiscovery::CreateInstanceCollectionQuery().Analytic
1005End IFunctionDiscovery::CreateInstanceCollectionQuery().Analytic
1006Begin IFunctionDiscovery::CreateInstanceQuery().Analytic
1007End IFunctionDiscovery::CreateInstanceQuery().Analytic
1008Begin IFunctionDiscovery::AddInstance().Analytic
1009End IFunctionDiscovery::AddInstance().Analytic
1010Begin IFunctionDiscovery::RemoveInstance().Analytic
1011End IFunctionDiscovery::RemoveInstance().Analytic
1012Begin IFunctionInstanceCollectionQuery::Execute().Analytic
1013End IFunctionInstanceCollectionQuery::Execute().Analytic
1014Begin IFunctionInstanceCollectionQuery2::Advise().Analytic
1015End IFunctionInstanceCollectionQuery2::Advise().Analytic
1016Begin IFunctionInstanceCollectionQuery2::Unadvise().Analytic
1017End IFunctionInstanceCollectionQuery2::Unadvise().Analytic
1018Begin IFunctionInstanceCollectionQuery2::Start().Analytic
1019End IFunctionInstanceCollectionQuery2::Start().Analytic
1020Begin IFunctionInstanceCollectionQuery2::Stop().Analytic
1021End IFunctionInstanceCollectionQuery2::Stop().Analytic
1022Begin IFunctionInstanceCollectionQuery2::QueryService().Analytic
1023End IFunctionInstanceCollectionQuery2::QueryService().Analytic
1024Begin IFunctionInstanceQuery::Execute().Analytic
1025End IFunctionInstanceQuery::Execute().Analytic
1026Begin IFunctionDiscoveryProvider::Initialize().Analytic
1027End IFunctionDiscoveryProvider::Initialize().Analytic
1028Begin IFunctionDiscoveryProvider::Query().Analytic
1029End IFunctionDiscoveryProvider::Query().Analytic
1030Begin IFunctionDiscoveryProvider::EndQuery().Analytic
1031End IFunctionDiscoveryProvider::EndQuery().Analytic
1032Begin IFunctionDiscoveryProvider::InstancePropertyStoreValidateAccess().Analytic
1033End IFunctionDiscoveryProvider::InstancePropertyStoreValidateAccess().Analytic
1034Begin IFunctionDiscoveryProvider::InstancePropertyStoreOpen().Analytic
1035End IFunctionDiscoveryProvider::InstancePropertyStoreOpen().Analytic
1036Begin IFunctionDiscoveryProvider::InstancePropertyStoreFlush().Analytic
1037End IFunctionDiscoveryProvider::InstancePropertyStoreFlush().Analytic
1038Begin IFunctionDiscoveryProvider::InstanceQueryService().Analytic
1039End IFunctionDiscoveryProvider::InstanceQueryService().Analytic
1040Begin IFunctionDiscoveryProvider::InstanceReleased().Analytic
1041End IFunctionDiscoveryProvider::InstanceReleased().Analytic
1042Begin IProviderPublishing::CreateInstance().Analytic
1043End IProviderPublishing::CreateInstance().Analytic
1044Begin IProviderPublishing::RemoveInstance().Analytic
1045End IProviderPublishing::RemoveInstance().Analytic
1046Begin Provider IServiceProvider::QueryService().Analytic
1047End Provider IServiceProvider::QueryService().Analytic
1048Begin Provider IProviderProperties::GetCount().Analytic
1049End Provider IProviderProperties::GetCount().Analytic
1050Begin Provider IProviderProperties::GetAt().Analytic
1051End Provider IProviderProperties::GetAt().Analytic
1052Begin Provider IProviderProperties::GetValue().Analytic
1053End Provider IProviderProperties::GetValue().Analytic
1054Begin Provider IProviderProperties::SetValue().Analytic
1055End Provider IProviderProperties::SetValue().Analytic
1056Begin asyncronous query.Analytic
1057Asynchronous query complete.Analytic

Event ID 1000 — Begin IFunctionDiscovery::GetInstanceCollection().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_GetInstanceCollection
Opcode
Start

Description

Begin IFunctionDiscovery::GetInstanceCollection(). Category: Begin_IFunctionDiscoveryGetInstanceCollection__Category.

Message #

Begin IFunctionDiscovery::GetInstanceCollection().  Category: %1

Fields #

NameDescription
Begin_IFunctionDiscoveryGetInstanceCollection__CategoryBegin IFunctionDiscovery::GetInstanceCollection(). Category.
Category UnicodeString—
Subcategory UnicodeString—
IncludeSubcategories Boolean—

Event ID 1001 — End IFunctionDiscovery::GetInstanceCollection().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_GetInstanceCollection
Opcode
Stop

Description

End IFunctionDiscovery::GetInstanceCollection(). Category: End_IFunctionDiscoveryGetInstanceCollection__Category.

Message #

End IFunctionDiscovery::GetInstanceCollection().  Category: %1

Fields #

NameDescription
End_IFunctionDiscoveryGetInstanceCollection__CategoryEnd IFunctionDiscovery::GetInstanceCollection(). Category.
Category UnicodeString—
Subcategory UnicodeString—
IncludeSubcategories Boolean—

Event ID 1002 — Begin IFunctionDiscovery::GetInstance().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_GetInstance
Opcode
Start

Description

Begin IFunctionDiscovery::GetInstance(). FIID: Begin_IFunctionDiscoveryGetInstance__FIID.

Message #

Begin IFunctionDiscovery::GetInstance().  FIID: %1

Fields #

NameDescription
Begin_IFunctionDiscoveryGetInstance__FIID UnicodeStringBegin IFunctionDiscovery::GetInstance(). FIID.
FunctionInstanceID UnicodeString—

Event ID 1003 — End IFunctionDiscovery::GetInstance().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_GetInstance
Opcode
Stop

Description

End IFunctionDiscovery::GetInstance(). FIID: End_IFunctionDiscoveryGetInstance__FIID.

Message #

End IFunctionDiscovery::GetInstance().  FIID: %1

Fields #

NameDescription
End_IFunctionDiscoveryGetInstance__FIID UnicodeStringEnd IFunctionDiscovery::GetInstance(). FIID.
FunctionInstanceID UnicodeString—

Event ID 1004 — Begin IFunctionDiscovery::CreateInstanceCollectionQuery().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_CreateInstanceCollectionQuery
Opcode
Start

Description

Begin IFunctionDiscovery::CreateInstanceCollectionQuery(). Category: Begin_IFunctionDiscoveryCreateInstanceCollectionQuery__Category.

Message #

Begin IFunctionDiscovery::CreateInstanceCollectionQuery().  Category: %1

Fields #

NameDescription
Begin_IFunctionDiscoveryCreateInstanceCollectionQuery__CategoryBegin IFunctionDiscovery::CreateInstanceCollectionQuery(). Category.
Category UnicodeString—
Subcategory UnicodeString—
IncludeSubcategories Boolean—

Event ID 1005 — End IFunctionDiscovery::CreateInstanceCollectionQuery().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_CreateInstanceCollectionQuery
Opcode
Stop

Description

End IFunctionDiscovery::CreateInstanceCollectionQuery(). Category: End_IFunctionDiscoveryCreateInstanceCollectionQuery__Category.

Message #

End IFunctionDiscovery::CreateInstanceCollectionQuery().  Category: %1

Fields #

NameDescription
End_IFunctionDiscoveryCreateInstanceCollectionQuery__CategoryEnd IFunctionDiscovery::CreateInstanceCollectionQuery(). Category.
Category UnicodeString—
Subcategory UnicodeString—
IncludeSubcategories Boolean—

Event ID 1006 — Begin IFunctionDiscovery::CreateInstanceQuery().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_CreateInstanceQuery
Opcode
Start

Description

Begin IFunctionDiscovery::CreateInstanceQuery(). FIID: Begin_IFunctionDiscoveryCreateInstanceQuery__FIID.

Message #

Begin IFunctionDiscovery::CreateInstanceQuery().  FIID: %1

Fields #

NameDescription
Begin_IFunctionDiscoveryCreateInstanceQuery__FIID UnicodeStringBegin IFunctionDiscovery::CreateInstanceQuery(). FIID.
FunctionInstanceID UnicodeString—

Event ID 1007 — End IFunctionDiscovery::CreateInstanceQuery().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_CreateInstanceQuery
Opcode
Stop

Description

End IFunctionDiscovery::CreateInstanceQuery(). FIID: End_IFunctionDiscoveryCreateInstanceQuery__FIID.

Message #

End IFunctionDiscovery::CreateInstanceQuery().  FIID: %1

Fields #

NameDescription
End_IFunctionDiscoveryCreateInstanceQuery__FIID UnicodeStringEnd IFunctionDiscovery::CreateInstanceQuery(). FIID.
FunctionInstanceID UnicodeString—

Event ID 1008 — Begin IFunctionDiscovery::AddInstance().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_AddInstance
Opcode
Start

Description

Begin IFunctionDiscovery::AddInstance(). Category: Begin_IFunctionDiscoveryAddInstance__Category.

Message #

Begin IFunctionDiscovery::AddInstance().  Category: %1

Fields #

NameDescription
Begin_IFunctionDiscoveryAddInstance__CategoryBegin IFunctionDiscovery::AddInstance(). Category.
Category UnicodeString—
Subcategory UnicodeString—
ProviderInstanceID UnicodeString—

Event ID 1009 — End IFunctionDiscovery::AddInstance().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_AddInstance
Opcode
Stop

Description

End IFunctionDiscovery::AddInstance(). Category: End_IFunctionDiscoveryAddInstance__Category.

Message #

End IFunctionDiscovery::AddInstance().  Category: %1

Fields #

NameDescription
End_IFunctionDiscoveryAddInstance__CategoryEnd IFunctionDiscovery::AddInstance(). Category.
Category UnicodeString—
Subcategory UnicodeString—
ProviderInstanceID UnicodeString—

Event ID 1010 — Begin IFunctionDiscovery::RemoveInstance().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_RemoveInstance
Opcode
Start

Description

Begin IFunctionDiscovery::RemoveInstance(). Category: Begin_IFunctionDiscoveryRemoveInstance__Category.

Message #

Begin IFunctionDiscovery::RemoveInstance().  Category: %1

Fields #

NameDescription
Begin_IFunctionDiscoveryRemoveInstance__CategoryBegin IFunctionDiscovery::RemoveInstance(). Category.
Category UnicodeString—
Subcategory UnicodeString—
ProviderInstanceID UnicodeString—

Event ID 1011 — End IFunctionDiscovery::RemoveInstance().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_RemoveInstance
Opcode
Stop

Description

End IFunctionDiscovery::RemoveInstance(). Category: End_IFunctionDiscoveryRemoveInstance__Category.

Message #

End IFunctionDiscovery::RemoveInstance().  Category: %1

Fields #

NameDescription
End_IFunctionDiscoveryRemoveInstance__CategoryEnd IFunctionDiscovery::RemoveInstance(). Category.
Category UnicodeString—
Subcategory UnicodeString—
ProviderInstanceID UnicodeString—

Event ID 1012 — Begin IFunctionInstanceCollectionQuery::Execute().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryExecute
Opcode
Start

Description

Begin IFunctionInstanceCollectionQuery::Execute(). Category: Begin_IFunctionInstanceCollectionQueryExecute__Category.

Message #

Begin IFunctionInstanceCollectionQuery::Execute().  Category: %1

Fields #

NameDescription
Begin_IFunctionInstanceCollectionQueryExecute__CategoryBegin IFunctionInstanceCollectionQuery::Execute(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1013 — End IFunctionInstanceCollectionQuery::Execute().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryExecute
Opcode
Stop

Description

End IFunctionInstanceCollectionQuery::Execute(). Category: End_IFunctionInstanceCollectionQueryExecute__Category.

Message #

End IFunctionInstanceCollectionQuery::Execute().  Category: %1

Fields #

NameDescription
End_IFunctionInstanceCollectionQueryExecute__CategoryEnd IFunctionInstanceCollectionQuery::Execute(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1014 — Begin IFunctionInstanceCollectionQuery2::Advise().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryAdvise
Opcode
Start

Description

Begin IFunctionInstanceCollectionQuery2::Advise(). Category: Begin_IFunctionInstanceCollectionQuery2Advise__Category.

Message #

Begin IFunctionInstanceCollectionQuery2::Advise().  Category: %1

Fields #

NameDescription
Begin_IFunctionInstanceCollectionQuery2Advise__CategoryBegin IFunctionInstanceCollectionQuery2::Advise(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1015 — End IFunctionInstanceCollectionQuery2::Advise().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryAdvise
Opcode
Stop

Description

End IFunctionInstanceCollectionQuery2::Advise(). Category: End_IFunctionInstanceCollectionQuery2Advise__Category.

Message #

End IFunctionInstanceCollectionQuery2::Advise().  Category: %1

Fields #

NameDescription
End_IFunctionInstanceCollectionQuery2Advise__CategoryEnd IFunctionInstanceCollectionQuery2::Advise(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1016 — Begin IFunctionInstanceCollectionQuery2::Unadvise().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryUnadvise
Opcode
Start

Description

Begin IFunctionInstanceCollectionQuery2::Unadvise(). Category: Begin_IFunctionInstanceCollectionQuery2Unadvise__Category.

Message #

Begin IFunctionInstanceCollectionQuery2::Unadvise().  Category: %1

Fields #

NameDescription
Begin_IFunctionInstanceCollectionQuery2Unadvise__CategoryBegin IFunctionInstanceCollectionQuery2::Unadvise(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1017 — End IFunctionInstanceCollectionQuery2::Unadvise().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryUnadvise
Opcode
Stop

Description

End IFunctionInstanceCollectionQuery2::Unadvise(). Category: End_IFunctionInstanceCollectionQuery2Unadvise__Category.

Message #

End IFunctionInstanceCollectionQuery2::Unadvise().  Category: %1

Fields #

NameDescription
End_IFunctionInstanceCollectionQuery2Unadvise__CategoryEnd IFunctionInstanceCollectionQuery2::Unadvise(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1018 — Begin IFunctionInstanceCollectionQuery2::Start().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryStart
Opcode
Start

Description

Begin IFunctionInstanceCollectionQuery2::Start(). Category: Begin_IFunctionInstanceCollectionQuery2Start__Category.

Message #

Begin IFunctionInstanceCollectionQuery2::Start().  Category: %1

Fields #

NameDescription
Begin_IFunctionInstanceCollectionQuery2Start__CategoryBegin IFunctionInstanceCollectionQuery2::Start(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1019 — End IFunctionInstanceCollectionQuery2::Start().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryStart
Opcode
Stop

Description

End IFunctionInstanceCollectionQuery2::Start(). Category: End_IFunctionInstanceCollectionQuery2Start__Category.

Message #

End IFunctionInstanceCollectionQuery2::Start().  Category: %1

Fields #

NameDescription
End_IFunctionInstanceCollectionQuery2Start__CategoryEnd IFunctionInstanceCollectionQuery2::Start(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1020 — Begin IFunctionInstanceCollectionQuery2::Stop().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryStop
Opcode
Start

Description

Begin IFunctionInstanceCollectionQuery2::Stop(). Category: Begin_IFunctionInstanceCollectionQuery2Stop__Category.

Message #

Begin IFunctionInstanceCollectionQuery2::Stop().  Category: %1

Fields #

NameDescription
Begin_IFunctionInstanceCollectionQuery2Stop__CategoryBegin IFunctionInstanceCollectionQuery2::Stop(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1021 — End IFunctionInstanceCollectionQuery2::Stop().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryStop
Opcode
Stop

Description

End IFunctionInstanceCollectionQuery2::Stop(). Category: End_IFunctionInstanceCollectionQuery2Stop__Category.

Message #

End IFunctionInstanceCollectionQuery2::Stop().  Category: %1

Fields #

NameDescription
End_IFunctionInstanceCollectionQuery2Stop__CategoryEnd IFunctionInstanceCollectionQuery2::Stop(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1022 — Begin IFunctionInstanceCollectionQuery2::QueryService().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryQueryService
Opcode
Start

Description

Begin IFunctionInstanceCollectionQuery2::QueryService(). Category: Begin_IFunctionInstanceCollectionQuery2QueryService__Category.

Message #

Begin IFunctionInstanceCollectionQuery2::QueryService().  Category: %1

Fields #

NameDescription
Begin_IFunctionInstanceCollectionQuery2QueryService__CategoryBegin IFunctionInstanceCollectionQuery2::QueryService(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1023 — End IFunctionInstanceCollectionQuery2::QueryService().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryQueryService
Opcode
Stop

Description

End IFunctionInstanceCollectionQuery2::QueryService(). Category: End_IFunctionInstanceCollectionQuery2QueryService__Category.

Message #

End IFunctionInstanceCollectionQuery2::QueryService().  Category: %1

Fields #

NameDescription
End_IFunctionInstanceCollectionQuery2QueryService__CategoryEnd IFunctionInstanceCollectionQuery2::QueryService(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1024 — Begin IFunctionInstanceQuery::Execute().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_FunctionInstanceQueryExecute
Opcode
Start

Description

Begin IFunctionInstanceQuery::Execute(). Category: Begin_IFunctionInstanceQueryExecute__Category.

Message #

Begin IFunctionInstanceQuery::Execute().  Category: %1

Fields #

NameDescription
Begin_IFunctionInstanceQueryExecute__CategoryBegin IFunctionInstanceQuery::Execute(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1025 — End IFunctionInstanceQuery::Execute().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_FunctionInstanceQueryExecute
Opcode
Stop

Description

End IFunctionInstanceQuery::Execute(). Category: End_IFunctionInstanceQueryExecute__Category.

Message #

End IFunctionInstanceQuery::Execute().  Category: %1

Fields #

NameDescription
End_IFunctionInstanceQueryExecute__CategoryEnd IFunctionInstanceQuery::Execute(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1026 — Begin IFunctionDiscoveryProvider::Initialize().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderInitialize
Opcode
Start

Description

Begin IFunctionDiscoveryProvider::Initialize(). Category: Begin_IFunctionDiscoveryProviderInitialize__Category.

Message #

Begin IFunctionDiscoveryProvider::Initialize().  Category: %1

Fields #

NameDescription
Begin_IFunctionDiscoveryProviderInitialize__CategoryBegin IFunctionDiscoveryProvider::Initialize(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1027 — End IFunctionDiscoveryProvider::Initialize().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderInitialize
Opcode
Stop

Description

End IFunctionDiscoveryProvider::Initialize(). Category: End_IFunctionDiscoveryProviderInitialize__Category.

Message #

End IFunctionDiscoveryProvider::Initialize().  Category: %1

Fields #

NameDescription
End_IFunctionDiscoveryProviderInitialize__CategoryEnd IFunctionDiscoveryProvider::Initialize(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1028 — Begin IFunctionDiscoveryProvider::Query().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderQuery
Opcode
Start

Description

Begin IFunctionDiscoveryProvider::Query(). Category: Begin_IFunctionDiscoveryProviderQuery__Category.

Message #

Begin IFunctionDiscoveryProvider::Query().  Category: %1

Fields #

NameDescription
Begin_IFunctionDiscoveryProviderQuery__CategoryBegin IFunctionDiscoveryProvider::Query(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1029 — End IFunctionDiscoveryProvider::Query().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderQuery
Opcode
Stop

Description

End IFunctionDiscoveryProvider::Query(). Category: End_IFunctionDiscoveryProviderQuery__Category.

Message #

End IFunctionDiscoveryProvider::Query().  Category: %1

Fields #

NameDescription
End_IFunctionDiscoveryProviderQuery__CategoryEnd IFunctionDiscoveryProvider::Query(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1030 — Begin IFunctionDiscoveryProvider::EndQuery().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderEndQuery
Opcode
Start

Description

Begin IFunctionDiscoveryProvider::EndQuery(). Category: Begin_IFunctionDiscoveryProviderEndQuery__Category.

Message #

Begin IFunctionDiscoveryProvider::EndQuery().  Category: %1

Fields #

NameDescription
Begin_IFunctionDiscoveryProviderEndQuery__CategoryBegin IFunctionDiscoveryProvider::EndQuery(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1031 — End IFunctionDiscoveryProvider::EndQuery().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderEndQuery
Opcode
Stop

Description

End IFunctionDiscoveryProvider::EndQuery(). Category: End_IFunctionDiscoveryProviderEndQuery__Category.

Message #

End IFunctionDiscoveryProvider::EndQuery().  Category: %1

Fields #

NameDescription
End_IFunctionDiscoveryProviderEndQuery__CategoryEnd IFunctionDiscoveryProvider::EndQuery(). Category.
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1032 — Begin IFunctionDiscoveryProvider::InstancePropertyStoreValidateAccess().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderInstancePropertyStoreValidateAccess
Opcode
Start

Description

Begin IFunctionDiscoveryProvider::InstancePropertyStoreValidateAccess(). FIID: Begin_IFunctionDiscoveryProviderInstancePropertyStoreValidateAccess__FIID.

Message #

Begin IFunctionDiscoveryProvider::InstancePropertyStoreValidateAccess().  FIID: %1

Fields #

NameDescription
Begin_IFunctionDiscoveryProviderInstancePropertyStoreValidateAccess__FIID UnicodeStringBegin IFunctionDiscoveryProvider::InstancePropertyStoreValidateAccess(). FIID.
FunctionInstanceID UnicodeString—

Event ID 1033 — End IFunctionDiscoveryProvider::InstancePropertyStoreValidateAccess().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderInstancePropertyStoreValidateAccess
Opcode
Stop

Description

End IFunctionDiscoveryProvider::InstancePropertyStoreValidateAccess(). FIID: End_IFunctionDiscoveryProviderInstancePropertyStoreValidateAccess__FIID.

Message #

End IFunctionDiscoveryProvider::InstancePropertyStoreValidateAccess().  FIID: %1

Fields #

NameDescription
End_IFunctionDiscoveryProviderInstancePropertyStoreValidateAccess__FIID UnicodeStringEnd IFunctionDiscoveryProvider::InstancePropertyStoreValidateAccess(). FIID.
FunctionInstanceID UnicodeString—

Event ID 1034 — Begin IFunctionDiscoveryProvider::InstancePropertyStoreOpen().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderInstancePropertyStoreOpen
Opcode
Start

Description

Begin IFunctionDiscoveryProvider::InstancePropertyStoreOpen(). FIID: Begin_IFunctionDiscoveryProviderInstancePropertyStoreOpen__FIID.

Message #

Begin IFunctionDiscoveryProvider::InstancePropertyStoreOpen().  FIID: %1

Fields #

NameDescription
Begin_IFunctionDiscoveryProviderInstancePropertyStoreOpen__FIID UnicodeStringBegin IFunctionDiscoveryProvider::InstancePropertyStoreOpen(). FIID.
FunctionInstanceID UnicodeString—

Event ID 1035 — End IFunctionDiscoveryProvider::InstancePropertyStoreOpen().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderInstancePropertyStoreOpen
Opcode
Stop

Description

End IFunctionDiscoveryProvider::InstancePropertyStoreOpen(). FIID: End_IFunctionDiscoveryProviderInstancePropertyStoreOpen__FIID.

Message #

End IFunctionDiscoveryProvider::InstancePropertyStoreOpen().  FIID: %1

Fields #

NameDescription
End_IFunctionDiscoveryProviderInstancePropertyStoreOpen__FIID UnicodeStringEnd IFunctionDiscoveryProvider::InstancePropertyStoreOpen(). FIID.
FunctionInstanceID UnicodeString—

Event ID 1036 — Begin IFunctionDiscoveryProvider::InstancePropertyStoreFlush().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderInstancePropertyStoreFlush
Opcode
Start

Description

Begin IFunctionDiscoveryProvider::InstancePropertyStoreFlush(). FIID: Begin_IFunctionDiscoveryProviderInstancePropertyStoreFlush__FIID.

Message #

Begin IFunctionDiscoveryProvider::InstancePropertyStoreFlush().  FIID: %1

Fields #

NameDescription
Begin_IFunctionDiscoveryProviderInstancePropertyStoreFlush__FIID UnicodeStringBegin IFunctionDiscoveryProvider::InstancePropertyStoreFlush(). FIID.
FunctionInstanceID UnicodeString—

Event ID 1037 — End IFunctionDiscoveryProvider::InstancePropertyStoreFlush().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderInstancePropertyStoreFlush
Opcode
Stop

Description

End IFunctionDiscoveryProvider::InstancePropertyStoreFlush(). FIID: End_IFunctionDiscoveryProviderInstancePropertyStoreFlush__FIID.

Message #

End IFunctionDiscoveryProvider::InstancePropertyStoreFlush().  FIID: %1

Fields #

NameDescription
End_IFunctionDiscoveryProviderInstancePropertyStoreFlush__FIID UnicodeStringEnd IFunctionDiscoveryProvider::InstancePropertyStoreFlush(). FIID.
FunctionInstanceID UnicodeString—

Event ID 1038 — Begin IFunctionDiscoveryProvider::InstanceQueryService().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderInstanceQueryService
Opcode
Start

Description

Begin IFunctionDiscoveryProvider::InstanceQueryService(). FIID: Begin_IFunctionDiscoveryProviderInstanceQueryService__FIID.

Message #

Begin IFunctionDiscoveryProvider::InstanceQueryService().  FIID: %1

Fields #

NameDescription
Begin_IFunctionDiscoveryProviderInstanceQueryService__FIID UnicodeStringBegin IFunctionDiscoveryProvider::InstanceQueryService(). FIID.
FunctionInstanceID UnicodeString—

Event ID 1039 — End IFunctionDiscoveryProvider::InstanceQueryService().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderInstanceQueryService
Opcode
Stop

Description

End IFunctionDiscoveryProvider::InstanceQueryService(). FIID: End_IFunctionDiscoveryProviderInstanceQueryService__FIID.

Message #

End IFunctionDiscoveryProvider::InstanceQueryService().  FIID: %1

Fields #

NameDescription
End_IFunctionDiscoveryProviderInstanceQueryService__FIID UnicodeStringEnd IFunctionDiscoveryProvider::InstanceQueryService(). FIID.
FunctionInstanceID UnicodeString—

Event ID 1040 — Begin IFunctionDiscoveryProvider::InstanceReleased().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderInstanceReleased
Opcode
Start

Description

Begin IFunctionDiscoveryProvider::InstanceReleased(). FIID: Begin_IFunctionDiscoveryProviderInstanceReleased__FIID.

Message #

Begin IFunctionDiscoveryProvider::InstanceReleased().  FIID: %1

Fields #

NameDescription
Begin_IFunctionDiscoveryProviderInstanceReleased__FIID UnicodeStringBegin IFunctionDiscoveryProvider::InstanceReleased(). FIID.
FunctionInstanceID UnicodeString—

Event ID 1041 — End IFunctionDiscoveryProvider::InstanceReleased().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderInstanceReleased
Opcode
Stop

Description

End IFunctionDiscoveryProvider::InstanceReleased(). FIID: End_IFunctionDiscoveryProviderInstanceReleased__FIID.

Message #

End IFunctionDiscoveryProvider::InstanceReleased().  FIID: %1

Fields #

NameDescription
End_IFunctionDiscoveryProviderInstanceReleased__FIID UnicodeStringEnd IFunctionDiscoveryProvider::InstanceReleased(). FIID.
FunctionInstanceID UnicodeString—

Event ID 1042 — Begin IProviderPublishing::CreateInstance().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderPublishingCreateInstance
Opcode
Start

Description

Begin IProviderPublishing::CreateInstance(). Category: Begin_IProviderPublishingCreateInstance__Category.

Message #

Begin IProviderPublishing::CreateInstance().  Category: %1

Fields #

NameDescription
Begin_IProviderPublishingCreateInstance__CategoryBegin IProviderPublishing::CreateInstance(). Category.
Category UnicodeString—
Subcategory UnicodeString—
ProviderInstanceID UnicodeString—

Event ID 1043 — End IProviderPublishing::CreateInstance().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderPublishingCreateInstance
Opcode
Stop

Description

End IProviderPublishing::CreateInstance(). Category: End_IProviderPublishingCreateInstance__Category.

Message #

End IProviderPublishing::CreateInstance().  Category: %1

Fields #

NameDescription
End_IProviderPublishingCreateInstance__CategoryEnd IProviderPublishing::CreateInstance(). Category.
Category UnicodeString—
Subcategory UnicodeString—
ProviderInstanceID UnicodeString—

Event ID 1044 — Begin IProviderPublishing::RemoveInstance().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderPublishingRemoveInstance
Opcode
Start

Description

Begin IProviderPublishing::RemoveInstance(). Category: Begin_IProviderPublishingRemoveInstance__Category.

Message #

Begin IProviderPublishing::RemoveInstance().  Category: %1

Fields #

NameDescription
Begin_IProviderPublishingRemoveInstance__CategoryBegin IProviderPublishing::RemoveInstance(). Category.
Category UnicodeString—
Subcategory UnicodeString—
ProviderInstanceID UnicodeString—

Event ID 1045 — End IProviderPublishing::RemoveInstance().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderPublishingRemoveInstance
Opcode
Stop

Description

End IProviderPublishing::RemoveInstance(). Category: End_IProviderPublishingRemoveInstance__Category.

Message #

End IProviderPublishing::RemoveInstance().  Category: %1

Fields #

NameDescription
End_IProviderPublishingRemoveInstance__CategoryEnd IProviderPublishing::RemoveInstance(). Category.
Category UnicodeString—
Subcategory UnicodeString—
ProviderInstanceID UnicodeString—

Event ID 1046 — Begin Provider IServiceProvider::QueryService().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderQueryService
Opcode
Start

Description

Begin Provider IServiceProvider::QueryService(). Category: Category.

Message #

Begin Provider IServiceProvider::QueryService().  Category: %1

Fields #

NameDescription
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1047 — End Provider IServiceProvider::QueryService().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderQueryService
Opcode
Stop

Description

End Provider IServiceProvider::QueryService(). Category: Category.

Message #

End Provider IServiceProvider::QueryService().  Category: %1

Fields #

NameDescription
Category UnicodeString—
Subcategory UnicodeString—

Event ID 1048 — Begin Provider IProviderProperties::GetCount().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderPropertiesGetCount
Opcode
Start

Description

Begin Provider IProviderProperties::GetCount(). FIID: FunctionInstanceID.

Message #

Begin Provider IProviderProperties::GetCount().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString—

Event ID 1049 — End Provider IProviderProperties::GetCount().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderPropertiesGetCount
Opcode
Stop

Description

End Provider IProviderProperties::GetCount(). FIID: FunctionInstanceID.

Message #

End Provider IProviderProperties::GetCount().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString—

Event ID 1050 — Begin Provider IProviderProperties::GetAt().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderPropertiesGetAt
Opcode
Start

Description

Begin Provider IProviderProperties::GetAt(). FIID: FunctionInstanceID.

Message #

Begin Provider IProviderProperties::GetAt().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString—

Event ID 1051 — End Provider IProviderProperties::GetAt().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_ProviderPropertiesGetAt
Opcode
Stop

Description

End Provider IProviderProperties::GetAt(). FIID: FunctionInstanceID.

Message #

End Provider IProviderProperties::GetAt().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString—

Event ID 1052 — Begin Provider IProviderProperties::GetValue().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_PropertiesGetValue
Opcode
Start

Description

Begin Provider IProviderProperties::GetValue(). FIID: FunctionInstanceID.

Message #

Begin Provider IProviderProperties::GetValue().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString—
fmtid GUID—
pid HexInt32—

Event ID 1053 — End Provider IProviderProperties::GetValue().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_PropertiesGetValue
Opcode
Stop

Description

End Provider IProviderProperties::GetValue(). FIID: FunctionInstanceID.

Message #

End Provider IProviderProperties::GetValue().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString—
fmtid GUID—
pid HexInt32—

Event ID 1054 — Begin Provider IProviderProperties::SetValue().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_PropertiesSetValue
Opcode
Start

Description

Begin Provider IProviderProperties::SetValue(). FIID: FunctionInstanceID.

Message #

Begin Provider IProviderProperties::SetValue().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString—
fmtid GUID—
pid HexInt32—

Event ID 1055 — End Provider IProviderProperties::SetValue().

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_PropertiesSetValue
Opcode
Stop

Description

End Provider IProviderProperties::SetValue(). FIID: FunctionInstanceID.

Message #

End Provider IProviderProperties::SetValue().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString—
fmtid GUID—
pid HexInt32—

Event ID 1056 — Begin asyncronous query.

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_AsyncQuery
Opcode
Start

Description

Begin asyncronous query. Category: Begin_asyncronous_query__Category.

Message #

Begin asyncronous query.  Category: %1

Fields #

NameDescription
Begin_asyncronous_query__CategoryBegin asyncronous query. Category.
Category UnicodeString—
Subcategory UnicodeString—
querycookie UInt64—

Event ID 1057 — Asynchronous query complete.

Provider
Microsoft-Windows-FunctionDiscovery
Channel
Analytic
Task
FunDisc_AsyncQuery
Opcode
Stop

Description

Asynchronous query complete. Category: Asynchronous_query_complete__Category.

Message #

Asynchronous query complete.  Category: %1

Fields #

NameDescription
Asynchronous_query_complete__CategoryAsynchronous query complete. Category.
Category UnicodeString—
Subcategory UnicodeString—
querycookie UInt64—