Microsoft-Windows-TabletPC-MathRecognizer

25 events across 1 channel

Event	Title	Channel
1	RecognitionStart	Operational
2	RecognitionStop	Operational
3	RecognitionStrokes	Operational
4	RecognitionRegions	Operational
5	RecognitionPartitions	Operational
6	ResetRecognitionContext	Operational
7	HintApplication	Operational
8	ResetLastConstraint	Operational
9	RecognitionFailed	Operational
10	RecognitionAlternatesStart	Operational
11	RecognitionAlternatesStop	Operational
12	RecognitionTest	Operational
13	RecognitionSymbolRecoStart	Operational
14	RecognitionSymbolRecoStop	Operational
15	RecognitionStructureRecoStart	Operational
16	RecognitionStructureRecoStop	Operational
17	ProcessWorkingSetRecognitionBegin	Operational
18	ProcessWorkingSetRecognitionEnd	Operational
19	QuickSymbolCorrection	Operational
20	CreateMathRecognizerStart	Operational
21	CreateMathRecognizerStop	Operational
22	PostProcessingRecoResultStart	Operational
23	PostProcessingRecoResultStop	Operational
24	CreateMathRecognizerContextStart	Operational
25	CreateMathRecognizerContextStop	Operational

Event ID 1: RecognitionStart

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: Recognition
Opcode: Start

Event ID 2: RecognitionStop

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: Recognition
Opcode: Stop

Event ID 3: RecognitionStrokes

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: RecognitionStrokes

Fields #

Name	Description
`intvalue` UInt32

Event ID 4: RecognitionRegions

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: RecognitionRegions

Fields #

Name	Description
`intvalue` UInt32

Event ID 5: RecognitionPartitions

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: RecognitionPartitions

Fields #

Name	Description
`intvalue` UInt32

Event ID 6: ResetRecognitionContext

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: ResetRecognitionContext

Event ID 7: HintApplication

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: HintApplication

Event ID 8: ResetLastConstraint

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: ResetLastConstraint

Event ID 9: RecognitionFailed

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: RecognitionFailed

Event ID 10: RecognitionAlternatesStart

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: RecognitionAlternates
Opcode: Start

Event ID 11: RecognitionAlternatesStop

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: RecognitionAlternates
Opcode: Stop

Event ID 12: RecognitionTest

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: RecognitionTest

Fields #

Name	Description
`intvalue` UInt32

Event ID 13: RecognitionSymbolRecoStart

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: RecognitionSymbolReco
Opcode: Start

Event ID 14: RecognitionSymbolRecoStop

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: RecognitionSymbolReco
Opcode: Stop

Event ID 15: RecognitionStructureRecoStart

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: RecognitionStructureReco
Opcode: Start

Event ID 16: RecognitionStructureRecoStop

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: RecognitionStructureReco
Opcode: Stop

Event ID 17: ProcessWorkingSetRecognitionBegin

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: ProcessWorkingSetRecognitionBegin

Fields #

Name	Description
`intvalue` UInt32

Event ID 18: ProcessWorkingSetRecognitionEnd

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: ProcessWorkingSetRecognitionEnd

Fields #

Name	Description
`intvalue` UInt32

Event ID 19: QuickSymbolCorrection

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: QuickSymbolCorrection

Event ID 20: CreateMathRecognizerStart

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: CreateMathRecognizer
Opcode: Start

Event ID 21: CreateMathRecognizerStop

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: CreateMathRecognizer
Opcode: Stop

Event ID 22: PostProcessingRecoResultStart

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: PostProcessingRecoResult
Opcode: Start

Event ID 23: PostProcessingRecoResultStop

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: PostProcessingRecoResult
Opcode: Stop

Event ID 24: CreateMathRecognizerContextStart

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: CreateMathRecognizerContext
Opcode: Start

Event ID 25: CreateMathRecognizerContextStop

Provider: Microsoft-Windows-TabletPC-MathRecognizer
Channel: Operational
Task: CreateMathRecognizerContext
Opcode: Stop

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID bdb462fc-a297-49a2-bf2e-4f1809e12abc

Defined in Program, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.5074 · captured 2026-06-02

Downloads

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-TabletPC-MathRecognizer

Event ID 1: RecognitionStart

Event ID 2: RecognitionStop

Event ID 3: RecognitionStrokes

Fields #

Event ID 4: RecognitionRegions

Fields #

Event ID 5: RecognitionPartitions

Fields #

Event ID 6: ResetRecognitionContext

Event ID 7: HintApplication

Event ID 8: ResetLastConstraint

Event ID 9: RecognitionFailed

Event ID 10: RecognitionAlternatesStart

Event ID 11: RecognitionAlternatesStop

Event ID 12: RecognitionTest

Fields #

Event ID 13: RecognitionSymbolRecoStart

Event ID 14: RecognitionSymbolRecoStop

Event ID 15: RecognitionStructureRecoStart

Event ID 16: RecognitionStructureRecoStop

Event ID 17: ProcessWorkingSetRecognitionBegin

Fields #

Event ID 18: ProcessWorkingSetRecognitionEnd

Fields #

Event ID 19: QuickSymbolCorrection

Event ID 20: CreateMathRecognizerStart

Event ID 21: CreateMathRecognizerStop

Event ID 22: PostProcessingRecoResultStart

Event ID 23: PostProcessingRecoResultStop

Event ID 24: CreateMathRecognizerContextStart

Event ID 25: CreateMathRecognizerContextStop

Provenance

Downloads

Credits

Keyboard shortcuts

Search operators