Microsoft-Windows-TabletPC-MathInput

81 events across 1 channel

Event	Title	Channel
1	StrokeEraseStart	Operational
2	StrokeEraseStop	Operational
3	StrokeErase	Operational
4	PanelClearStart	Operational
5	PanelClearStop	Operational
6	GetAlternatesStart	Operational
7	GetAlternatesStop	Operational
8	ResultPanelPaintStart	Operational
9	ResultPanelPaintStop	Operational
10	StrokeUndoStart	Operational
11	StrokeUndoStop	Operational
12	StrokeRedoStart	Operational
13	StrokeRedoStop	Operational
14	HintUndoStart	Operational
15	HintUndoStop	Operational
16	HintRedoStart	Operational
17	HintRedoStop	Operational
18	InkDragAndDropStart	Operational
19	InkDragAndDropStop	Operational
20	WindowResizeStart	Operational
21	WindowResizeStop	Operational
22	LassoIncrementalStart	Operational
23	LassoIncrementalStop	Operational
24	StrokeErase24	Operational
25	GetAlternates	Operational
26	LassoIncremental	Operational
27	StrokeWriteStart	Operational
28	StrokeWriteStop	Operational
29	StrokeWrite	Operational
30	InkPanelPaintStart	Operational
31	InkPanelPaintStop	Operational
32	StrokeSelect	Operational
33	StrokeSelect33	Operational
34	MathInkPanelCreateStart	Operational
35	MathInkPanelCreateStop	Operational
36	MathResultPanelCreateStart	Operational
37	MathResultPanelCreateStop	Operational
38	MathInputPanelCreateStart	Operational
39	MathInputPanelCreateStop	Operational
40	MathInputControlCreateStart	Operational
41	MathInputControlCreateStop	Operational
42	MathmlRendererCreateStart	Operational
43	MathmlRendererCreateStop	Operational
44	RTSCreateStart	Operational
45	RTSCreateStop	Operational
46	LayoutManagerCreateStart	Operational
47	LayoutManagerCreateStop	Operational
48	CaptionBarCreateStart	Operational
49	CaptionBarCreateStop	Operational
50	ButtonBarCreateStart	Operational
51	ButtonBarCreateStop	Operational
52	InsertBarCreateStart	Operational
53	InsertBarCreateStop	Operational
54	ShowFrameStart	Operational
55	ShowFrameStop	Operational
56	CachedBitmapCreateStart	Operational
57	CachedBitmapCreateStop	Operational
58	AlternateArrayCreateStart	Operational
59	AlternateArrayCreateStop	Operational
60	AttachWindowlessControlStart	Operational
61	AttachWindowlessControlStop	Operational
62	UpdateRegistrySettingsStart	Operational
63	UpdateRegistrySettingsStop	Operational
64	StylusDownStart	Operational
65	StylusDownStop	Operational
66	StylusUpStart	Operational
67	StylusUpStop	Operational
68	PacketsStart	Operational
69	PacketsStop	Operational
70	ButtonPaintStart	Operational
71	ButtonPaintStop	Operational
72	PaintWindowFrameStart	Operational
73	PaintWindowFrameStop	Operational
74	FixAlphaStart	Operational
75	FixAlphaStop	Operational
76	MathmlRendererDrawStart	Operational
77	MathmlRendererDrawStop	Operational
78	MathmlRendererGetSizeStart	Operational
79	MathmlRendererGetSizeStop	Operational
80	MathmlRendererDrawDCStart	Operational
81	MathmlRendererDrawDCStop	Operational

Event ID 1: StrokeEraseStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: StrokeErase
Opcode: Start

Event ID 2: StrokeEraseStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: StrokeErase
Opcode: Stop

Event ID 3: StrokeErase

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: StrokeErase

Fields #

Name	Description
`intvalue` UInt32

Event ID 4: PanelClearStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: PanelClear
Opcode: Start

Event ID 5: PanelClearStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: PanelClear
Opcode: Stop

Event ID 6: GetAlternatesStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: GetAlternates
Opcode: Start

Event ID 7: GetAlternatesStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: GetAlternates
Opcode: Stop

Event ID 8: ResultPanelPaintStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: ResultPanelPaint
Opcode: Start

Event ID 9: ResultPanelPaintStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: ResultPanelPaint
Opcode: Stop

Event ID 10: StrokeUndoStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: StrokeUndo
Opcode: Start

Event ID 11: StrokeUndoStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: StrokeUndo
Opcode: Stop

Event ID 12: StrokeRedoStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: StrokeRedo
Opcode: Start

Event ID 13: StrokeRedoStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: StrokeRedo
Opcode: Stop

Event ID 14: HintUndoStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: HintUndo
Opcode: Start

Event ID 15: HintUndoStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: HintUndo
Opcode: Stop

Event ID 16: HintRedoStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: HintRedo
Opcode: Start

Event ID 17: HintRedoStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: HintRedo
Opcode: Stop

Event ID 18: InkDragAndDropStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: InkDragAndDrop
Opcode: Start

Event ID 19: InkDragAndDropStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: InkDragAndDrop
Opcode: Stop

Event ID 20: WindowResizeStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: WindowResize
Opcode: Start

Event ID 21: WindowResizeStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: WindowResize
Opcode: Stop

Event ID 22: LassoIncrementalStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: LassoIncremental
Opcode: Start

Event ID 23: LassoIncrementalStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: LassoIncremental
Opcode: Stop

Event ID 24: StrokeErase24

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: StrokeErase

Fields #

Name	Description
`intvalue` UInt32

Event ID 25: GetAlternates

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: GetAlternates

Fields #

Name	Description
`intvalue` UInt32

Event ID 26: LassoIncremental

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: LassoIncremental

Fields #

Name	Description
`intvalue` UInt32

Event ID 27: StrokeWriteStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: StrokeWrite
Opcode: Start

Event ID 28: StrokeWriteStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: StrokeWrite
Opcode: Stop

Event ID 29: StrokeWrite

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: StrokeWrite

Fields #

Name	Description
`intvalue` UInt32

Event ID 30: InkPanelPaintStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: InkPanelPaint
Opcode: Start

Event ID 31: InkPanelPaintStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: InkPanelPaint
Opcode: Stop

Event ID 32: StrokeSelect

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: StrokeSelect

Fields #

Name	Description
`intvalue` UInt32

Event ID 33: StrokeSelect33

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: StrokeSelect

Fields #

Name	Description
`intvalue` UInt32

Event ID 34: MathInkPanelCreateStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: MathInkPanelCreate
Opcode: Start

Event ID 35: MathInkPanelCreateStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: MathInkPanelCreate
Opcode: Stop

Event ID 36: MathResultPanelCreateStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: MathResultPanelCreate
Opcode: Start

Event ID 37: MathResultPanelCreateStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: MathResultPanelCreate
Opcode: Stop

Event ID 38: MathInputPanelCreateStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: MathInputPanelCreate
Opcode: Start

Event ID 39: MathInputPanelCreateStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: MathInputPanelCreate
Opcode: Stop

Event ID 40: MathInputControlCreateStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: MathInputControlCreate
Opcode: Start

Event ID 41: MathInputControlCreateStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: MathInputControlCreate
Opcode: Stop

Event ID 42: MathmlRendererCreateStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: MathmlRendererCreate
Opcode: Start

Event ID 43: MathmlRendererCreateStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: MathmlRendererCreate
Opcode: Stop

Event ID 44: RTSCreateStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: RTSCreate
Opcode: Start

Event ID 45: RTSCreateStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: RTSCreate
Opcode: Stop

Event ID 46: LayoutManagerCreateStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: LayoutManagerCreate
Opcode: Start

Event ID 47: LayoutManagerCreateStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: LayoutManagerCreate
Opcode: Stop

Event ID 48: CaptionBarCreateStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: CaptionBarCreate
Opcode: Start

Event ID 49: CaptionBarCreateStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: CaptionBarCreate
Opcode: Stop

Event ID 50: ButtonBarCreateStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: ButtonBarCreate
Opcode: Start

Event ID 51: ButtonBarCreateStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: ButtonBarCreate
Opcode: Stop

Event ID 52: InsertBarCreateStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: InsertBarCreate
Opcode: Start

Event ID 53: InsertBarCreateStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: InsertBarCreate
Opcode: Stop

Event ID 54: ShowFrameStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: ShowFrame
Opcode: Start

Event ID 55: ShowFrameStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: ShowFrame
Opcode: Stop

Event ID 56: CachedBitmapCreateStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: CachedBitmapCreate
Opcode: Start

Event ID 57: CachedBitmapCreateStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: CachedBitmapCreate
Opcode: Stop

Event ID 58: AlternateArrayCreateStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: AlternateArrayCreate
Opcode: Start

Event ID 59: AlternateArrayCreateStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: AlternateArrayCreate
Opcode: Stop

Event ID 60: AttachWindowlessControlStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: AttachWindowlessControl
Opcode: Start

Event ID 61: AttachWindowlessControlStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: AttachWindowlessControl
Opcode: Stop

Event ID 62: UpdateRegistrySettingsStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: UpdateRegistrySettings
Opcode: Start

Event ID 63: UpdateRegistrySettingsStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: UpdateRegistrySettings
Opcode: Stop

Event ID 64: StylusDownStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: StylusDown
Opcode: Start

Event ID 65: StylusDownStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: StylusDown
Opcode: Stop

Event ID 66: StylusUpStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: StylusUp
Opcode: Start

Event ID 67: StylusUpStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: StylusUp
Opcode: Stop

Event ID 68: PacketsStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: Packets
Opcode: Start

Event ID 69: PacketsStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: Packets
Opcode: Stop

Event ID 70: ButtonPaintStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: ButtonPaint
Opcode: Start

Event ID 71: ButtonPaintStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: ButtonPaint
Opcode: Stop

Event ID 72: PaintWindowFrameStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: PaintWindowFrame
Opcode: Start

Event ID 73: PaintWindowFrameStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: PaintWindowFrame
Opcode: Stop

Event ID 74: FixAlphaStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: FixAlpha
Opcode: Start

Event ID 75: FixAlphaStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: FixAlpha
Opcode: Stop

Event ID 76: MathmlRendererDrawStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: MathmlRendererDraw
Opcode: Start

Event ID 77: MathmlRendererDrawStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: MathmlRendererDraw
Opcode: Stop

Event ID 78: MathmlRendererGetSizeStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: MathmlRendererGetSize
Opcode: Start

Event ID 79: MathmlRendererGetSizeStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: MathmlRendererGetSize
Opcode: Stop

Event ID 80: MathmlRendererDrawDCStart

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: MathmlRendererDrawDC
Opcode: Start

Event ID 81: MathmlRendererDrawDCStop

Provider: Microsoft-Windows-TabletPC-MathInput
Channel: Operational
Task: MathmlRendererDrawDC
Opcode: Stop

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 8443ccb7-feb0-4b8d-8e28-8d4c7cb814e8

Defined in Program, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)