detection.wiki

Microsoft-Windows-Ncasvc

29 events across 1 channel

Event IDTitleChannel
1NCA service status changed.Operational
2NCA status update.Operational
3NCA API Activity Start, function: (ApiFunction).Operational
4NCA API Activity End, function: (ApiFunction), error: (Error).Operational
5NCA Evidence Collector Update, evcoll: (EvColl), old: (Old), new: (New).Operational
6NCA Probe Start, type: (Type), resource: (Resource).Operational
7NCA Probe End, type: (Type), resource: (Resource), result: (Result).Operational
8NCA Probe Callback, type: (Type), code: (Code), error: (Error).Operational
9NCA Source Configuration Update started.Operational
10NCA Source Configuration Update complete.Operational
11NCA Module ModuleName Initialization started.Operational
12NCA Module ModuleName Initialization complete with error Error.Operational
13NCA Module ModuleName Shutdown started.Operational
14NCA Module ModuleName Shutdown complete.Operational
15NCA Trigger Source.Operational
10001NCA PerfTrack Scenario Event.Operational
10002NCA PerfTrack Scenario Event.Operational
10003NCA PerfTrack Scenario Event.Operational
10004NCA PerfTrack Scenario Event.Operational
10005NCA PerfTrack Scenario Event.Operational
10006NCA PerfTrack Scenario Event.Operational
10007NCA PerfTrack Scenario Event.Operational
10008NCA PerfTrack Scenario Event.Operational
10009NCA PerfTrack Scenario Event.Operational
10010NCA PerfTrack Scenario Event.Operational
10011NCA PerfTrack Scenario Event.Operational
10012NCA PerfTrack Scenario Event.Operational
10013NCA PerfTrack Scenario Event.Operational
10014NCA PerfTrack Scenario Event.Operational

Event ID 1 — NCA service status changed.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational

Description

NCA service status changed. New Status: (Status).

Message #

NCA service status changed. New Status: (%1).

Fields #

NameDescription
Status UInt32— NTSTATUS reference

Event ID 2 — NCA status update.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational

Description

NCA status update. New Status: (Status, Substatus).

Message #

NCA status update. New Status: (%1, %2).

Fields #

NameDescription
Status UInt32— NTSTATUS reference
Substatus UInt32— NTSTATUS reference

Event ID 3 — NCA API Activity Start, function: (ApiFunction).

Provider
Microsoft-Windows-Ncasvc
Channel
Operational

Description

NCA API Activity Start, function: (ApiFunction).

Message #

NCA API Activity Start, function: (%1).

Fields #

NameDescription
ApiFunction UnicodeString—

Event ID 4 — NCA API Activity End, function: (ApiFunction), error: (Error).

Provider
Microsoft-Windows-Ncasvc
Channel
Operational

Description

NCA API Activity End, function: (ApiFunction), error: (Error).

Message #

NCA API Activity End, function: (%1), error: (%2).

Fields #

NameDescription
ApiFunction UnicodeString—
Error UInt64—

Event ID 5 — NCA Evidence Collector Update, evcoll: (EvColl), old: (Old), new: (New).

Provider
Microsoft-Windows-Ncasvc
Channel
Operational

Description

NCA Evidence Collector Update, evcoll: (EvColl), old: (Old), new: (New). User:(UserId).

Message #

NCA Evidence Collector Update, evcoll: (%1), old: (%2), new: (%3). User:(%4)

Fields #

NameDescription
EvColl UInt32—
Old Boolean—
New Boolean—
UserId UInt64—

Event ID 6 — NCA Probe Start, type: (Type), resource: (Resource).

Provider
Microsoft-Windows-Ncasvc
Channel
Operational

Description

NCA Probe Start, type: (Type), resource: (Resource).

Message #

NCA Probe Start, type: (%1), resource: (%2)

Fields #

NameDescription
Type UInt32—
Resource UnicodeString—

Event ID 7 — NCA Probe End, type: (Type), resource: (Resource), result: (Result).

Provider
Microsoft-Windows-Ncasvc
Channel
Operational

Description

NCA Probe End, type: (Type), resource: (Resource), result: (Result).

Message #

NCA Probe End, type: (%1), resource: (%2), result: (%3)

Fields #

NameDescription
Type UInt32—
Resource UnicodeString—
Result UInt32—

Event ID 8 — NCA Probe Callback, type: (Type), code: (Code), error: (Error).

Provider
Microsoft-Windows-Ncasvc
Channel
Operational

Description

NCA Probe Callback, type: (Type), code: (Code), error: (Error).

Message #

NCA Probe Callback, type: (%1), code: (%2), error: (%3)

Fields #

NameDescription
Type UInt32—
Code UInt64—
Error UInt64—

Event ID 9 — NCA Source Configuration Update started.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational

Description

NCA Source Configuration Update started.

Message #

NCA %1 Configuration Update started.

Fields #

NameDescription
Source UnicodeString—

Event ID 10 — NCA Source Configuration Update complete.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational

Description

NCA Source Configuration Update complete.

Message #

NCA %1 Configuration Update complete.

Fields #

NameDescription
Source UnicodeString—

Event ID 11 — NCA Module ModuleName Initialization started.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational

Description

NCA Module ModuleName Initialization started.

Message #

NCA Module %1 Initialization started.

Fields #

NameDescription
ModuleName UnicodeString—

Event ID 12 — NCA Module ModuleName Initialization complete with error Error.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational

Description

NCA Module ModuleName Initialization complete with error Error.

Message #

NCA Module %1 Initialization complete with error %2.

Fields #

NameDescription
ModuleName UnicodeString—
Error UInt64—

Event ID 13 — NCA Module ModuleName Shutdown started.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational

Description

NCA Module ModuleName Shutdown started.

Message #

NCA Module %1 Shutdown started.

Fields #

NameDescription
ModuleName UnicodeString—

Event ID 14 — NCA Module ModuleName Shutdown complete.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational

Description

NCA Module ModuleName Shutdown complete.

Message #

NCA Module %1 Shutdown complete.

Fields #

NameDescription
ModuleName UnicodeString—

Event ID 15 — NCA Trigger Source.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational

Description

NCA Trigger Source. Details: (Info).

Message #

NCA Trigger %1. Details: (%2).

Fields #

NameDescription
Source UnicodeString—
Info UnicodeString—

Event ID 10001 — NCA PerfTrack Scenario Event.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational
Task
NcaSvc_PerfTrack_InternetConnected_ActionableState
Opcode
Start

Description

NCA PerfTrack Scenario Event. MachineId: NCA_PerfTrack_Scenario_Event_MachineId, SessionId: SessionId, DeploymentId: DeploymentId, StopState: StopState.

Message #

NCA PerfTrack Scenario Event. MachineId: %1, SessionId: %2, DeploymentId: %3, StopState: %4.

Fields #

NameDescription
NCA_PerfTrack_Scenario_Event_MachineId UInt32NCA PerfTrack Scenario Event. MachineId.
SessionId UInt32—
DeploymentId UInt32—
StopState UInt32—
MachineIdentifier UInt32—
SessionIdentifier UInt32—
DeploymentIdentifier UInt32—

Event ID 10002 — NCA PerfTrack Scenario Event.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational
Task
NcaSvc_PerfTrack_InternetConnected_ActionableState
Opcode
Stop

Description

NCA PerfTrack Scenario Event. MachineId: NCA_PerfTrack_Scenario_Event_MachineId, SessionId: SessionId, DeploymentId: DeploymentId, StopState: StopState.

Message #

NCA PerfTrack Scenario Event. MachineId: %1, SessionId: %2, DeploymentId: %3, StopState: %4.

Fields #

NameDescription
NCA_PerfTrack_Scenario_Event_MachineId UInt32NCA PerfTrack Scenario Event. MachineId.
SessionId UInt32—
DeploymentId UInt32—
StopState UInt32—
MachineIdentifier UInt32—
SessionIdentifier UInt32—
DeploymentIdentifier UInt32—

Event ID 10003 — NCA PerfTrack Scenario Event.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational
Task
NcaSvc_PerfTrack_InternetConnected_ResolveName
Opcode
Start

Description

NCA PerfTrack Scenario Event. MachineId: NCA_PerfTrack_Scenario_Event_MachineId, SessionId: SessionId, DeploymentId: DeploymentId, StopState: StopState.

Message #

NCA PerfTrack Scenario Event. MachineId: %1, SessionId: %2, DeploymentId: %3, StopState: %4.

Fields #

NameDescription
NCA_PerfTrack_Scenario_Event_MachineId UInt32NCA PerfTrack Scenario Event. MachineId.
SessionId UInt32—
DeploymentId UInt32—
StopState UInt32—
MachineIdentifier UInt32—
SessionIdentifier UInt32—
DeploymentIdentifier UInt32—

Event ID 10004 — NCA PerfTrack Scenario Event.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational
Task
NcaSvc_PerfTrack_InternetConnected_ResolveName
Opcode
Stop

Description

NCA PerfTrack Scenario Event. MachineId: NCA_PerfTrack_Scenario_Event_MachineId, SessionId: SessionId, DeploymentId: DeploymentId, StopState: StopState.

Message #

NCA PerfTrack Scenario Event. MachineId: %1, SessionId: %2, DeploymentId: %3, StopState: %4.

Fields #

NameDescription
NCA_PerfTrack_Scenario_Event_MachineId UInt32NCA PerfTrack Scenario Event. MachineId.
SessionId UInt32—
DeploymentId UInt32—
StopState UInt32—
MachineIdentifier UInt32—
SessionIdentifier UInt32—
DeploymentIdentifier UInt32—

Event ID 10005 — NCA PerfTrack Scenario Event.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational
Task
NcaSvc_PerfTrack_InternetConnected_DAConnected
Opcode
Start

Description

NCA PerfTrack Scenario Event. MachineId: NCA_PerfTrack_Scenario_Event_MachineId, SessionId: SessionId, DeploymentId: DeploymentId, StopState: StopState.

Message #

NCA PerfTrack Scenario Event. MachineId: %1, SessionId: %2, DeploymentId: %3, StopState: %4.

Fields #

NameDescription
NCA_PerfTrack_Scenario_Event_MachineId UInt32NCA PerfTrack Scenario Event. MachineId.
SessionId UInt32—
DeploymentId UInt32—
StopState UInt32—
MachineIdentifier UInt32—
SessionIdentifier UInt32—
DeploymentIdentifier UInt32—

Event ID 10006 — NCA PerfTrack Scenario Event.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational
Task
NcaSvc_PerfTrack_InternetConnected_DAConnected
Opcode
Stop

Description

NCA PerfTrack Scenario Event. MachineId: NCA_PerfTrack_Scenario_Event_MachineId, SessionId: SessionId, DeploymentId: DeploymentId, StopState: StopState.

Message #

NCA PerfTrack Scenario Event. MachineId: %1, SessionId: %2, DeploymentId: %3, StopState: %4.

Fields #

NameDescription
NCA_PerfTrack_Scenario_Event_MachineId UInt32NCA PerfTrack Scenario Event. MachineId.
SessionId UInt32—
DeploymentId UInt32—
StopState UInt32—
MachineIdentifier UInt32—
SessionIdentifier UInt32—
DeploymentIdentifier UInt32—

Event ID 10007 — NCA PerfTrack Scenario Event.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational
Task
NcaSvc_PerfTrack_SmartcardRequired_SmartcardEntered
Opcode
Start

Description

NCA PerfTrack Scenario Event. MachineId: NCA_PerfTrack_Scenario_Event_MachineId, SessionId: SessionId, DeploymentId: DeploymentId, StopState: StopState.

Message #

NCA PerfTrack Scenario Event. MachineId: %1, SessionId: %2, DeploymentId: %3, StopState: %4.

Fields #

NameDescription
NCA_PerfTrack_Scenario_Event_MachineId UInt32NCA PerfTrack Scenario Event. MachineId.
SessionId UInt32—
DeploymentId UInt32—
StopState UInt32—
MachineIdentifier UInt32—
SessionIdentifier UInt32—
DeploymentIdentifier UInt32—

Event ID 10008 — NCA PerfTrack Scenario Event.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational
Task
NcaSvc_PerfTrack_SmartcardRequired_SmartcardEntered
Opcode
Stop

Description

NCA PerfTrack Scenario Event. MachineId: NCA_PerfTrack_Scenario_Event_MachineId, SessionId: SessionId, DeploymentId: DeploymentId, StopState: StopState.

Message #

NCA PerfTrack Scenario Event. MachineId: %1, SessionId: %2, DeploymentId: %3, StopState: %4.

Fields #

NameDescription
NCA_PerfTrack_Scenario_Event_MachineId UInt32NCA PerfTrack Scenario Event. MachineId.
SessionId UInt32—
DeploymentId UInt32—
StopState UInt32—
MachineIdentifier UInt32—
SessionIdentifier UInt32—
DeploymentIdentifier UInt32—

Event ID 10009 — NCA PerfTrack Scenario Event.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational
Task
NcaSvc_PerfTrack_SmartcardEntered_DAConnected
Opcode
Start

Description

NCA PerfTrack Scenario Event. MachineId: NCA_PerfTrack_Scenario_Event_MachineId, SessionId: SessionId, DeploymentId: DeploymentId, StopState: StopState.

Message #

NCA PerfTrack Scenario Event. MachineId: %1, SessionId: %2, DeploymentId: %3, StopState: %4.

Fields #

NameDescription
NCA_PerfTrack_Scenario_Event_MachineId UInt32NCA PerfTrack Scenario Event. MachineId.
SessionId UInt32—
DeploymentId UInt32—
StopState UInt32—
MachineIdentifier UInt32—
SessionIdentifier UInt32—
DeploymentIdentifier UInt32—

Event ID 10010 — NCA PerfTrack Scenario Event.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational
Task
NcaSvc_PerfTrack_SmartcardEntered_DAConnected
Opcode
Stop

Description

NCA PerfTrack Scenario Event. MachineId: NCA_PerfTrack_Scenario_Event_MachineId, SessionId: SessionId, DeploymentId: DeploymentId, StopState: StopState.

Message #

NCA PerfTrack Scenario Event. MachineId: %1, SessionId: %2, DeploymentId: %3, StopState: %4.

Fields #

NameDescription
NCA_PerfTrack_Scenario_Event_MachineId UInt32NCA PerfTrack Scenario Event. MachineId.
SessionId UInt32—
DeploymentId UInt32—
StopState UInt32—
MachineIdentifier UInt32—
SessionIdentifier UInt32—
DeploymentIdentifier UInt32—

Event ID 10011 — NCA PerfTrack Scenario Event.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational
Task
NcaSvc_PerfTrack_NAPRequired_DAConnected
Opcode
Start

Description

NCA PerfTrack Scenario Event. MachineId: NCA_PerfTrack_Scenario_Event_MachineId, SessionId: SessionId, DeploymentId: DeploymentId, StopState: StopState.

Message #

NCA PerfTrack Scenario Event. MachineId: %1, SessionId: %2, DeploymentId: %3, StopState: %4.

Fields #

NameDescription
NCA_PerfTrack_Scenario_Event_MachineId UInt32NCA PerfTrack Scenario Event. MachineId.
SessionId UInt32—
DeploymentId UInt32—
StopState UInt32—
MachineIdentifier UInt32—
SessionIdentifier UInt32—
DeploymentIdentifier UInt32—

Event ID 10012 — NCA PerfTrack Scenario Event.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational
Task
NcaSvc_PerfTrack_NAPRequired_DAConnected
Opcode
Stop

Description

NCA PerfTrack Scenario Event. MachineId: NCA_PerfTrack_Scenario_Event_MachineId, SessionId: SessionId, DeploymentId: DeploymentId, StopState: StopState.

Message #

NCA PerfTrack Scenario Event. MachineId: %1, SessionId: %2, DeploymentId: %3, StopState: %4.

Fields #

NameDescription
NCA_PerfTrack_Scenario_Event_MachineId UInt32NCA PerfTrack Scenario Event. MachineId.
SessionId UInt32—
DeploymentId UInt32—
StopState UInt32—
MachineIdentifier UInt32—
SessionIdentifier UInt32—
DeploymentIdentifier UInt32—

Event ID 10013 — NCA PerfTrack Scenario Event.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational
Task
NcaSvc_PerfTrack_InternetConnected_DTESucceeded
Opcode
Start

Description

NCA PerfTrack Scenario Event. MachineId: NCA_PerfTrack_Scenario_Event_MachineId, SessionId: SessionId, DeploymentId: DeploymentId, StopState: StopState.

Message #

NCA PerfTrack Scenario Event. MachineId: %1, SessionId: %2, DeploymentId: %3, StopState: %4.

Fields #

NameDescription
NCA_PerfTrack_Scenario_Event_MachineId UInt32NCA PerfTrack Scenario Event. MachineId.
SessionId UInt32—
DeploymentId UInt32—
StopState UInt32—
MachineIdentifier UInt32—
SessionIdentifier UInt32—
DeploymentIdentifier UInt32—

Event ID 10014 — NCA PerfTrack Scenario Event.

Provider
Microsoft-Windows-Ncasvc
Channel
Operational
Task
NcaSvc_PerfTrack_InternetConnected_DTESucceeded
Opcode
Stop

Description

NCA PerfTrack Scenario Event. MachineId: NCA_PerfTrack_Scenario_Event_MachineId, SessionId: SessionId, DeploymentId: DeploymentId, StopState: StopState.

Message #

NCA PerfTrack Scenario Event. MachineId: %1, SessionId: %2, DeploymentId: %3, StopState: %4.

Fields #

NameDescription
NCA_PerfTrack_Scenario_Event_MachineId UInt32NCA PerfTrack Scenario Event. MachineId.
SessionId UInt32—
DeploymentId UInt32—
StopState UInt32—
MachineIdentifier UInt32—
SessionIdentifier UInt32—
DeploymentIdentifier UInt32—