Microsoft-Windows-TabletPC-Platform-Input-Ninput

55 events across 1 channel

Event	Title	Channel
1	NinputWmPointerStart	Operational
2	NinputWmPointerStop	Operational
3	NinputScrollerInitializeStart	Operational
4	NinputScrollerInitializeStop	Operational
5	NinputScrollerInitializeListViewStart	Operational
6	NinputScrollerInitializeListViewStop	Operational
7	NinputScrollerInitializeGenericStart	Operational
8	NinputScrollerInitializeGenericStop	Operational
9	NinputScrollerOnVerticalScrollBar	Operational
10	NinputScrollerOnHorizontalScrollBar	Operational
11	NinputSendWmGestureGlobalStart	Operational
12	NinputSendWmGestureGlobalStop	Operational
13	NinputSendWmGestureStart	Operational
14	NinputSendWmGestureStop	Operational
15	NinputSendMouseStart	Operational
16	NinputSendMouseStop	Operational
17	NinputSendWmTouchStart	Operational
18	NinputSendWmTouchStop	Operational
19	NinputConfiguration	Operational
20	NinputConfiguration20	Operational
21	NinputConfiguration21	Operational
22	NinputConfiguration22	Operational
23	NinputConfiguration23	Operational
24	NinputWmGestureGlobalStart	Operational
25	NinputWmGestureGlobalStop	Operational
26	NinputWmGestureStart	Operational
27	NinputWmGestureStop	Operational
28	NinputWmFlickStart	Operational
29	NinputWmFlickStop	Operational
30	NinputScrollerOnTimerStart	Operational
31	NinputScrollerOnTimerStop	Operational
32	NinputSendMouse	Operational
33	NinputWmPointer	Operational
34	NinputICDetectInteractionStart	Operational
35	NinputICDetectInteractionStop	Operational
36	NinputICCreateStart	Operational
37	NinputICCreateStop	Operational
38	NinputICDestroyStart	Operational
39	NinputICDestroyStop	Operational
40	NinputICProcessPointerStart	Operational
41	NinputICProcessPointerStop	Operational
42	NinputWmPointer42	Operational
43	NinputSendWmGesture	Operational
44	NinputICProcessInertiaStart	Operational
45	NinputICProcessInertiaStop	Operational
46	NinputICStopStart	Operational
47	NinputICStop	Operational
48	NinputICOutputCallbackStart	Operational
49	NinputICOutputCallbackStop	Operational
50	NinputTouchpadInertiaStop	Operational
51	NinputMouseWheel	Operational
52	NinputMouseWheel52	Operational
53	NinputConfigurePTPScrolling	Operational
54	NinputConfigurePTPScrolling54	Operational
55	NinputConfigurePTPScrolling55	Operational

Event ID 1: NinputWmPointerStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputWmPointer
Opcode: Start

Fields #

Name	Description
`frameId` UInt32

Event ID 2: NinputWmPointerStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputWmPointer
Opcode: Stop

Fields #

Name	Description
`frameId` UInt32

Event ID 3: NinputScrollerInitializeStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputScrollerInitialize
Opcode: Start

Event ID 4: NinputScrollerInitializeStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputScrollerInitialize
Opcode: Stop

Event ID 5: NinputScrollerInitializeListViewStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputScrollerInitializeListView
Opcode: Start

Event ID 6: NinputScrollerInitializeListViewStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputScrollerInitializeListView
Opcode: Stop

Event ID 7: NinputScrollerInitializeGenericStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputScrollerInitializeGeneric
Opcode: Start

Event ID 8: NinputScrollerInitializeGenericStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputScrollerInitializeGeneric
Opcode: Stop

Event ID 9: NinputScrollerOnVerticalScrollBar

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputScrollerOnVerticalScrollBar

Event ID 10: NinputScrollerOnHorizontalScrollBar

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputScrollerOnHorizontalScrollBar

Event ID 11: NinputSendWmGestureGlobalStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputSendWmGestureGlobal
Opcode: Start

Fields #

Name	Description
`ContactsDownCount` UInt32
`PacketsInContactCount` UInt32
`HistoryPacketsInContactCount` UInt32

Event ID 12: NinputSendWmGestureGlobalStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputSendWmGestureGlobal
Opcode: Stop

Event ID 13: NinputSendWmGestureStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputSendWmGesture
Opcode: Start

Fields #

Name	Description
`GestureId` UInt32

Event ID 14: NinputSendWmGestureStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputSendWmGesture
Opcode: Stop

Fields #

Name	Description
`GestureId` UInt32

Event ID 15: NinputSendMouseStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputSendMouse
Opcode: Start

Fields #

Name	Description
`promotionFlags` UInt32

Event ID 16: NinputSendMouseStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputSendMouse
Opcode: Stop

Fields #

Name	Description
`promotionFlags` UInt32

Event ID 17: NinputSendWmTouchStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputSendWmTouch
Opcode: Start

Event ID 18: NinputSendWmTouchStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputSendWmTouch
Opcode: Stop

Event ID 19: NinputConfiguration

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputConfiguration

Event ID 20: NinputConfiguration20

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputConfiguration

Event ID 21: NinputConfiguration21

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputConfiguration

Event ID 22: NinputConfiguration22

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputConfiguration

Event ID 23: NinputConfiguration23

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputConfiguration

Event ID 24: NinputWmGestureGlobalStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputWmGestureGlobal
Opcode: Start

Event ID 25: NinputWmGestureGlobalStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputWmGestureGlobal
Opcode: Stop

Event ID 26: NinputWmGestureStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputWmGesture
Opcode: Start

Event ID 27: NinputWmGestureStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputWmGesture
Opcode: Stop

Event ID 28: NinputWmFlickStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputWmFlick
Opcode: Start

Event ID 29: NinputWmFlickStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputWmFlick
Opcode: Stop

Event ID 30: NinputScrollerOnTimerStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputScrollerOnTimer
Opcode: Start

Event ID 31: NinputScrollerOnTimerStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputScrollerOnTimer
Opcode: Stop

Event ID 32: NinputSendMouse

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputSendMouse

Event ID 33: NinputWmPointer

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputWmPointer

Fields #

Name	Description
`frameId` UInt32

Event ID 34: NinputICDetectInteractionStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputICDetectInteraction
Opcode: Start

Fields #

Name	Description
`InteractionId` UInt32

Event ID 35: NinputICDetectInteractionStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputICDetectInteraction
Opcode: Stop

Fields #

Name	Description
`InteractionId` UInt32

Event ID 36: NinputICCreateStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputICCreate
Opcode: Start

Event ID 37: NinputICCreateStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputICCreate
Opcode: Stop

Event ID 38: NinputICDestroyStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputICDestroy
Opcode: Start

Event ID 39: NinputICDestroyStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputICDestroy
Opcode: Stop

Event ID 40: NinputICProcessPointerStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputICProcessPointer
Opcode: Start

Event ID 41: NinputICProcessPointerStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputICProcessPointer
Opcode: Stop

Event ID 42: NinputWmPointer42

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputWmPointer

Event ID 43: NinputSendWmGesture

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputSendWmGesture

Fields #

Name	Description
`GestureId` UInt32

Event ID 44: NinputICProcessInertiaStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputICProcessInertia
Opcode: Start

Event ID 45: NinputICProcessInertiaStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputICProcessInertia
Opcode: Stop

Event ID 46: NinputICStopStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputICStop
Opcode: Start

Event ID 47: NinputICStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputICStop
Opcode: Stop

Event ID 48: NinputICOutputCallbackStart

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputICOutputCallback
Opcode: Start

Event ID 49: NinputICOutputCallbackStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputICOutputCallback
Opcode: Stop

Event ID 50: NinputTouchpadInertiaStop

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputTouchpadInertiaStop

Event ID 51: NinputMouseWheel

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputMouseWheel

Fields #

Name	Description
`delta` Int32

Event ID 52: NinputMouseWheel52

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputMouseWheel

Fields #

Name	Description
`delta` Int32

Event ID 53: NinputConfigurePTPScrolling

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputConfigurePTPScrolling

Fields #

Name	Description
`scrollMode` UInt32

Event ID 54: NinputConfigurePTPScrolling54

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputConfigurePTPScrolling

Fields #

Name	Description
`scrollMode` UInt32

Event ID 55: NinputConfigurePTPScrolling55

Provider: Microsoft-Windows-TabletPC-Platform-Input-Ninput
Channel: Operational
Task: NinputConfigurePTPScrolling

Fields #

Name	Description
`scrollMode` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 2c3e6d9f-8298-450f-8e5d-49b724f1216f

Defined in ninput.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)