detection.wiki

Microsoft-Windows-StorDiag › Event 507

Event ID 507 — Completing a failed non-ReadWrite SCSI SRB request

Provider
Microsoft-Windows-StorDiag
Channel
Operational
Level
Error
Task
Class
Opcode
Completionofrequest.

Description

Completing a failed non-ReadWrite SCSI SRB request.

Message #

Completing a failed non-ReadWrite SCSI SRB request

Fields #

NameDescription
DeviceGUID GUID—
DeviceNumber UInt32—
Vendor AnsiString—
Model AnsiString—
FirmwareVersion AnsiString—
SerialNumber AnsiString—
DownLevelIrpStatus HexInt32—
SrbStatus UInt8—
ScsiStatus UInt8—
SenseKey UInt8—
AdditionalSenseCode UInt8—
AdditionalSenseCodeQualifier UInt8—
CdbByteCount UInt32—
CdbBytes Binary—
NumberOfRetriesDone UInt8—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorDiag",
    "guid": "F5D05B38-80A6-4653-825D-C414E4AB3C68",
    "event_source_name": "",
    "event_id": 507,
    "version": 1,
    "level": 2,
    "task": 200,
    "opcode": 101,
    "keywords": 576460752437641216,
    "time_created": "2022-04-07T17:41:19.261973+00:00",
    "event_record_id": 10,
    "correlation": {
      "ActivityID": "00000000-0000-0000-0000-000000000001"
    },
    "execution": {
      "process_id": 4,
      "thread_id": 32
    },
    "channel": "Microsoft-Windows-Storage-ClassPnP/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceGUID": "E9A1B7AB-024C-F6F4-5089-48CC840C29D0",
    "DeviceNumber": 1,
    "Vendor": "VendorCo",
    "Model": "ProductCode",
    "FirmwareVersion": "2.00",
    "SerialNumber": "9207032533193411390",
    "DownLevelIrpStatus": "0xc000000d",
    "SrbStatus": 132,
    "ScsiStatus": 2,
    "SenseKey": 5,
    "AdditionalSenseCode": 32,
    "AdditionalSenseCodeQualifier": 0,
    "CdbByteCount": 16,
    "CdbBytes": "9E100000000000000000000000200000",
    "NumberOfRetriesDone": 0
  },
  "message": ""
}

References #