Microsoft-Windows-Network-DataUsage

14 events across 1 channel

Event	Title	Channel
1001	CreateHelperStart	Analytic
1002	CreateHelperStop	Analytic
1003	SetVisibilityStart	Analytic
1004	SetVisibilityStop	Analytic
1005	ResetCountStart	Analytic
1006	ResetCountStop	Analytic
1007	GetDisplayTextStart	Analytic
1008	GetDisplayTextStop	Analytic
1009	SetListenerStart	Analytic
1010	SetListenerStop	Analytic
1011	ProcessUpdateStart	Analytic
1012	ProcessUpdateStop	Analytic
1013	CallSystemMonitorStart	Analytic
1014	CallSystemMonitorStop	Analytic

Event ID 1001: CreateHelperStart

Provider: Microsoft-Windows-Network-DataUsage
Channel: Analytic
Task: CreateHelper
Opcode: Start

Event ID 1002: CreateHelperStop

Provider: Microsoft-Windows-Network-DataUsage
Channel: Analytic
Task: CreateHelper
Opcode: Stop

Event ID 1003: SetVisibilityStart

Provider: Microsoft-Windows-Network-DataUsage
Channel: Analytic
Task: SetVisibility
Opcode: Start

Event ID 1004: SetVisibilityStop

Provider: Microsoft-Windows-Network-DataUsage
Channel: Analytic
Task: SetVisibility
Opcode: Stop

Event ID 1005: ResetCountStart

Provider: Microsoft-Windows-Network-DataUsage
Channel: Analytic
Task: ResetCount
Opcode: Start

Event ID 1006: ResetCountStop

Provider: Microsoft-Windows-Network-DataUsage
Channel: Analytic
Task: ResetCount
Opcode: Stop

Event ID 1007: GetDisplayTextStart

Provider: Microsoft-Windows-Network-DataUsage
Channel: Analytic
Task: GetDisplayText
Opcode: Start

Event ID 1008: GetDisplayTextStop

Provider: Microsoft-Windows-Network-DataUsage
Channel: Analytic
Task: GetDisplayText
Opcode: Stop

Event ID 1009: SetListenerStart

Provider: Microsoft-Windows-Network-DataUsage
Channel: Analytic
Task: SetListener
Opcode: Start

Event ID 1010: SetListenerStop

Provider: Microsoft-Windows-Network-DataUsage
Channel: Analytic
Task: SetListener
Opcode: Stop

Event ID 1011: ProcessUpdateStart

Provider: Microsoft-Windows-Network-DataUsage
Channel: Analytic
Task: ProcessUpdate
Opcode: Start

Event ID 1012: ProcessUpdateStop

Provider: Microsoft-Windows-Network-DataUsage
Channel: Analytic
Task: ProcessUpdate
Opcode: Stop

Event ID 1013: CallSystemMonitorStart

Provider: Microsoft-Windows-Network-DataUsage
Channel: Analytic
Task: CallSystemMonitor
Opcode: Start

Event ID 1014: CallSystemMonitorStop

Provider: Microsoft-Windows-Network-DataUsage
Channel: Analytic
Task: CallSystemMonitor
Opcode: Stop

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 5c1c9ab3-8689-4e41-90fa-85858306d7b7

Defined in datusage.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02

Downloads

Microsoft-Windows-Network-DataUsage registered manifest XML (WS2022-20348.4893) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)