detection.wiki

Microsoft-Windows-Storsvc › Event 1002

Event ID 1002 — For internal use only.

Provider
Microsoft-Windows-Storsvc
Channel
Diagnostic
Level
Informational

Description

For internal use only.

Message #

For internal use only.

Fields #

NameDescription
Version UInt32—
Epoch UInt32—
DiskIndex UInt32—
TotalDisks UInt32—
DiskNumber UInt32—
VendorId AnsiString—
ProductId AnsiString—
ProductRevision AnsiString—
SerialNumber AnsiString—
ParentId UnicodeString—
FileSystem UnicodeString—
BusType UInt32—
PartitionStyle UInt32—
VolumeCount UInt32—
ContainsRawVolumes Boolean—
Size UInt64—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Storsvc",
    "guid": "A963A23C-0058-521D-71EC-A1CCE6173F21",
    "event_source_name": "",
    "event_id": 1002,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-05T23:34:26.042356+00:00",
    "event_record_id": 1,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0003-B784-DBE43710DA01"
    },
    "execution": {
      "process_id": 7484,
      "thread_id": 5344
    },
    "channel": "Microsoft-Windows-Storsvc/Diagnostic",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Version": 2,
    "Epoch": 0,
    "DiskIndex": 0,
    "TotalDisks": 1,
    "DiskNumber": 0,
    "VendorId": "VMware, ",
    "ProductId": "VMware Virtual S",
    "ProductRevision": "1.0 ",
    "SerialNumber": "",
    "ParentId": "PCI\\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\\4&2509F6E&0&00A8",
    "FileSystem": "NTFS",
    "BusType": 10,
    "PartitionStyle": 1,
    "VolumeCount": 3,
    "ContainsRawVolumes": false,
    "Size": 134217728000
  },
  "message": ""
}

References #