Microsoft-Windows-TSF-UIManager

84 events across 1 channel

Event	Title	Channel
1	UIManager_CreateInstanceStart	UIManager_Channel
2	UIManager_CreateInstanceStop	UIManager_Channel
3	UIManager_DestructorStart	UIManager_Channel
4	UIManager_DestructorStop	UIManager_Channel
5	IUIManager_ShowCandidateListStart	UIManager_Channel
6	IUIManager_ShowCandidateListStop	UIManager_Channel
7	IUIManager_ShowImeCommandsStart	UIManager_Channel
8	IUIManager_ShowImeCommandsStop	UIManager_Channel
9	IUIManager_OnTargetPositionChangingStart	UIManager_Channel
10	IUIManager_OnTargetPositionChangingStop	UIManager_Channel
11	IUIManager_OnTargetPositionChangedStart	UIManager_Channel
12	IUIManager_OnTargetPositionChangedStop	UIManager_Channel
13	IUIManager_RefreshStart	UIManager_Channel
14	IUIManager_RefreshStop	UIManager_Channel
15	IUIManager_HideStart	UIManager_Channel
16	IUIManager_HideStop	UIManager_Channel
17	IUIManager_OnKeyPressedStart	UIManager_Channel
18	IUIManager_OnKeyPressedStop	UIManager_Channel
19	UIManager_UpdateKeyboardRectStart	UIManager_Channel
20	UIManager_UpdateKeyboardRectStop	UIManager_Channel
21	UIManager_OnAnimationStart	UIManager_Channel
22	UIManager_OnAnimationStartStop	UIManager_Channel
23	UIManager_OnAnimationFinishStart	UIManager_Channel
24	UIManager_OnAnimationFinishStop	UIManager_Channel
25	UIManager_OnKeyboardUIActionStart	UIManager_Channel
26	UIManager_OnKeyboardUIActionStop	UIManager_Channel
27	UIManager_OnTimerStart	UIManager_Channel
28	UIManager_OnTimerStop	UIManager_Channel
29	UIManager_OnMouseEventStart	UIManager_Channel
30	UIManager_OnMouseEventStop	UIManager_Channel
100	IMEPreferencesAndActionsHelper_CreateInstanceStart	UIManager_Channel
101	IMEPreferencesAndActionsHelper_CreateInstanceStop	UIManager_Channel
102	IMEPreferencesAndActionsHelper_LoadDataStart	UIManager_Channel
103	IMEPreferencesAndActionsHelper_LoadDataStop	UIManager_Channel
200	CommandingUIManager_CreateInstanceStart	UIManager_Channel
201	CommandingUIManager_CreateInstanceStop	UIManager_Channel
202	CommandingUIManager_OnCommandClickedStart	UIManager_Channel
203	CommandingUIManager_OnCommandClickedStop	UIManager_Channel
204	CommandingUIManager_OnCommandShowMenuStart	UIManager_Channel
205	CommandingUIManager_OnCommandShowMenuStop	UIManager_Channel
206	CommandingUIManager_HideImmediateStart	UIManager_Channel
207	CommandingUIManager_HideImmediateStop	UIManager_Channel
208	CommandingUIManager_ShowOnTimerStart	UIManager_Channel
209	CommandingUIManager_ShowOnTimerStop	UIManager_Channel
210	CommandingUIManager_AutoDismissStart	UIManager_Channel
211	CommandingUIManager_AutoDismissStop	UIManager_Channel
212	CommandingUI_Click	UIManager_Channel
213	CommandingUI_ContextMenuRequested	UIManager_Channel
214	CommandingUI_ContextMenuModeSelected	UIManager_Channel
215	CommandingUI_ContextMenuCanceled	UIManager_Channel
216	CommandingUI_UpdatePosition	UIManager_Channel
300	CandidateWindowUIManager_CreateInstanceStart	UIManager_Channel
301	CandidateWindowUIManager_CreateInstanceStop	UIManager_Channel
302	CandidateWindow_ShowStart	UIManager_Channel
303	CandidateWindow_ShowStop	UIManager_Channel
304	CandidateWindow_UpdateStart	UIManager_Channel
305	CandidateWindow_UpdateStop	UIManager_Channel
306	CandidateWindow_HideStart	UIManager_Channel
307	CandidateWindow_HideStop	UIManager_Channel
308	CandidateWindow_HandleActionStart	UIManager_Channel
309	CandidateWindow_HandleActionStop	UIManager_Channel
310	CandidateWindow_UpdatePosition	UIManager_Channel
311	CandidateWindow_SetView	UIManager_Channel
312	CandidateWindow_CreateUIThreadStart	UIManager_Channel
313	CandidateWindow_CreateUIThreadStop	UIManager_Channel
350	CandidateView_Click	UIManager_Channel
351	CandidateView_SetTopStart	UIManager_Channel
352	CandidateView_SetTopStop	UIManager_Channel
353	CandidateView_CreateInstanceStart	UIManager_Channel
354	CandidateView_CreateInstanceStop	UIManager_Channel
355	CandidateView_SetCandidateListStart	UIManager_Channel
356	CandidateView_SetCandidateListStop	UIManager_Channel
357	CandidateView_CloudConsentButton_Click	UIManager_Channel
358	CandidateView_CloudConsentHyperlink_Click	UIManager_Channel
400	TsfCandidateList_GetItemStart	UIManager_Channel
401	TsfCandidateList_GetItemStop	UIManager_Channel
402	TsfCandidateList_SetSelectionStart	UIManager_Channel
403	TsfCandidateList_SetSelectionStop	UIManager_Channel
500	CandListData_CreateStart	UIManager_Channel
501	CandListData_CreateStop	UIManager_Channel
502	CandListData_RefreshStart	UIManager_Channel
503	CandListData_RefreshStop	UIManager_Channel
504	CandListData_RefreshStart504	UIManager_Channel
505	CandListData_GrowCacheStop	UIManager_Channel

Event ID 1: UIManager_CreateInstanceStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: UIManager_CreateInstance
Opcode: Start

Event ID 2: UIManager_CreateInstanceStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: UIManager_CreateInstance
Opcode: Stop

Event ID 3: UIManager_DestructorStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: UIManager_Destructor
Opcode: Start

Event ID 4: UIManager_DestructorStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: UIManager_Destructor
Opcode: Stop

Event ID 5: IUIManager_ShowCandidateListStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: IUIManager_ShowCandidateList
Opcode: Start

Fields #

Name	Description
`contextFlags` UInt32
`cItems` Int32
`targetRangeLeft` Int32
`targetRangeTop` Int32
`targetRangeRight` Int32
`targetRangeBottom` Int32

Event ID 6: IUIManager_ShowCandidateListStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: IUIManager_ShowCandidateList
Opcode: Stop

Event ID 7: IUIManager_ShowImeCommandsStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: IUIManager_ShowImeCommands
Opcode: Start

Fields #

Name	Description
`contextFlags` UInt32
`cItems` Int32
`targetRangeLeft` Int32
`targetRangeTop` Int32
`targetRangeRight` Int32
`targetRangeBottom` Int32

Event ID 8: IUIManager_ShowImeCommandsStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: IUIManager_ShowImeCommands
Opcode: Stop

Event ID 9: IUIManager_OnTargetPositionChangingStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: IUIManager_OnTargetPositionChanging
Opcode: Start

Event ID 10: IUIManager_OnTargetPositionChangingStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: IUIManager_OnTargetPositionChanging
Opcode: Stop

Event ID 11: IUIManager_OnTargetPositionChangedStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: IUIManager_OnTargetPositionChanged
Opcode: Start

Fields #

Name	Description
`targetRangeLeft` Int32
`targetRangeTop` Int32
`targetRangeRight` Int32
`targetRangeBottom` Int32

Event ID 12: IUIManager_OnTargetPositionChangedStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: IUIManager_OnTargetPositionChanged
Opcode: Stop

Event ID 13: IUIManager_RefreshStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: IUIManager_Refresh
Opcode: Start

Fields #

Name	Description
`start` UInt32
`end` UInt32

Event ID 14: IUIManager_RefreshStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: IUIManager_Refresh
Opcode: Stop

Event ID 15: IUIManager_HideStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: IUIManager_Hide
Opcode: Start

Event ID 16: IUIManager_HideStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: IUIManager_Hide
Opcode: Stop

Event ID 17: IUIManager_OnKeyPressedStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: IUIManager_OnKeyPressed
Opcode: Start

Event ID 18: IUIManager_OnKeyPressedStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: IUIManager_OnKeyPressed
Opcode: Stop

Event ID 19: UIManager_UpdateKeyboardRectStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: UIManager_UpdateKeyboardRect
Opcode: Start

Fields #

Name	Description
`left` Int32
`top` Int32
`right` Int32
`bottom` Int32

Event ID 20: UIManager_UpdateKeyboardRectStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: UIManager_UpdateKeyboardRect
Opcode: Stop

Event ID 21: UIManager_OnAnimationStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: UIManager_OnAnimationStart
Opcode: Start

Event ID 22: UIManager_OnAnimationStartStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: UIManager_OnAnimationStart
Opcode: Stop

Event ID 23: UIManager_OnAnimationFinishStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: UIManager_OnAnimationFinish
Opcode: Start

Event ID 24: UIManager_OnAnimationFinishStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: UIManager_OnAnimationFinish
Opcode: Stop

Event ID 25: UIManager_OnKeyboardUIActionStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: UIManager_OnKeyboardUIAction
Opcode: Start

Event ID 26: UIManager_OnKeyboardUIActionStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: UIManager_OnKeyboardUIAction
Opcode: Stop

Event ID 27: UIManager_OnTimerStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: UIManager_OnTimer
Opcode: Start

Event ID 28: UIManager_OnTimerStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: UIManager_OnTimer
Opcode: Stop

Event ID 29: UIManager_OnMouseEventStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: UIManager_OnMouseEvent
Opcode: Start

Event ID 30: UIManager_OnMouseEventStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: UIManager_OnMouseEvent
Opcode: Stop

Event ID 100: IMEPreferencesAndActionsHelper_CreateInstanceStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: IMEPreferencesAndActionsHelper_CreateInstance
Opcode: Start

Event ID 101: IMEPreferencesAndActionsHelper_CreateInstanceStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: IMEPreferencesAndActionsHelper_CreateInstance
Opcode: Stop

Event ID 102: IMEPreferencesAndActionsHelper_LoadDataStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: IMEPreferencesAndActionsHelper_LoadData
Opcode: Start

Fields #

Name	Description
`langId` UInt32
`clsId` GUID
`guidProfile` GUID

Event ID 103: IMEPreferencesAndActionsHelper_LoadDataStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: IMEPreferencesAndActionsHelper_LoadData
Opcode: Stop

Event ID 200: CommandingUIManager_CreateInstanceStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CommandingUIManager_CreateInstance
Opcode: Start

Event ID 201: CommandingUIManager_CreateInstanceStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CommandingUIManager_CreateInstance
Opcode: Stop

Event ID 202: CommandingUIManager_OnCommandClickedStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CommandingUIManager_OnCommandClicked
Opcode: Start

Event ID 203: CommandingUIManager_OnCommandClickedStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CommandingUIManager_OnCommandClicked
Opcode: Stop

Event ID 204: CommandingUIManager_OnCommandShowMenuStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CommandingUIManager_OnCommandShowMenu
Opcode: Start

Event ID 205: CommandingUIManager_OnCommandShowMenuStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CommandingUIManager_OnCommandShowMenu
Opcode: Stop

Event ID 206: CommandingUIManager_HideImmediateStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CommandingUIManager_HideImmediate
Opcode: Start

Event ID 207: CommandingUIManager_HideImmediateStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CommandingUIManager_HideImmediate
Opcode: Stop

Event ID 208: CommandingUIManager_ShowOnTimerStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CommandingUIManager_ShowOnTimer
Opcode: Start

Event ID 209: CommandingUIManager_ShowOnTimerStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CommandingUIManager_ShowOnTimer
Opcode: Stop

Event ID 210: CommandingUIManager_AutoDismissStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CommandingUIManager_AutoDismiss
Opcode: Start

Event ID 211: CommandingUIManager_AutoDismissStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CommandingUIManager_AutoDismiss
Opcode: Stop

Event ID 212: CommandingUI_Click

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CommandingUI_Click

Event ID 213: CommandingUI_ContextMenuRequested

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CommandingUI_ContextMenuRequested

Event ID 214: CommandingUI_ContextMenuModeSelected

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CommandingUI_ContextMenuModeSelected

Fields #

Name	Description
`value` UInt32

Event ID 215: CommandingUI_ContextMenuCanceled

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CommandingUI_ContextMenuCanceled

Event ID 216: CommandingUI_UpdatePosition

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CommandingUI_UpdatePosition

Fields #

Name	Description
`left` Int32
`top` Int32
`right` Int32
`bottom` Int32

Event ID 300: CandidateWindowUIManager_CreateInstanceStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateWindowUIManager_CreateInstance
Opcode: Start

Event ID 301: CandidateWindowUIManager_CreateInstanceStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateWindowUIManager_CreateInstance
Opcode: Stop

Event ID 302: CandidateWindow_ShowStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateWindow_Show
Opcode: Start

Event ID 303: CandidateWindow_ShowStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateWindow_Show
Opcode: Stop

Event ID 304: CandidateWindow_UpdateStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateWindow_Update
Opcode: Start

Event ID 305: CandidateWindow_UpdateStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateWindow_Update
Opcode: Stop

Event ID 306: CandidateWindow_HideStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateWindow_Hide
Opcode: Start

Event ID 307: CandidateWindow_HideStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateWindow_Hide
Opcode: Stop

Event ID 308: CandidateWindow_HandleActionStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateWindow_HandleAction
Opcode: Start

Fields #

Name	Description
`action` UInt32
`param` Int32

Event ID 309: CandidateWindow_HandleActionStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateWindow_HandleAction
Opcode: Stop

Event ID 310: CandidateWindow_UpdatePosition

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateWindow_UpdatePosition

Fields #

Name	Description
`left` Int32
`top` Int32
`right` Int32
`bottom` Int32

Event ID 311: CandidateWindow_SetView

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateWindow_SetView

Fields #

Name	Description
`langid` UInt32
`viewflags` UInt32

Event ID 312: CandidateWindow_CreateUIThreadStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateWindow_CreateUIThread
Opcode: Start

Event ID 313: CandidateWindow_CreateUIThreadStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateWindow_CreateUIThread
Opcode: Stop

Event ID 350: CandidateView_Click

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateView_Click

Fields #

Name	Description
`value` UInt32

Event ID 351: CandidateView_SetTopStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateView_SetTop
Opcode: Start

Event ID 352: CandidateView_SetTopStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateView_SetTop
Opcode: Stop

Event ID 353: CandidateView_CreateInstanceStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateView_CreateInstance
Opcode: Start

Event ID 354: CandidateView_CreateInstanceStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateView_CreateInstance
Opcode: Stop

Event ID 355: CandidateView_SetCandidateListStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateView_SetCandidateList
Opcode: Start

Event ID 356: CandidateView_SetCandidateListStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateView_SetCandidateList
Opcode: Stop

Event ID 357: CandidateView_CloudConsentButton_Click

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateView_CloudConsentButton_Click

Event ID 358: CandidateView_CloudConsentHyperlink_Click

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandidateView_CloudConsentHyperlink_Click

Event ID 400: TsfCandidateList_GetItemStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: TsfCandidateList_GetItem
Opcode: Start

Fields #

Name	Description
`value` UInt32

Event ID 401: TsfCandidateList_GetItemStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: TsfCandidateList_GetItem
Opcode: Stop

Event ID 402: TsfCandidateList_SetSelectionStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: TsfCandidateList_SetSelection
Opcode: Start

Fields #

Name	Description
`index` UInt32
`commit` Boolean

Event ID 403: TsfCandidateList_SetSelectionStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: TsfCandidateList_SetSelection
Opcode: Stop

Event ID 500: CandListData_CreateStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandListData_Create
Opcode: Start

Event ID 501: CandListData_CreateStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandListData_Create
Opcode: Stop

Event ID 502: CandListData_RefreshStart

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandListData_Refresh
Opcode: Start

Fields #

Name	Description
`start` UInt32
`end` UInt32

Event ID 503: CandListData_RefreshStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandListData_Refresh
Opcode: Stop

Event ID 504: CandListData_RefreshStart504

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandListData_Refresh
Opcode: Start

Fields #

Name	Description
`start` UInt32
`end` UInt32

Event ID 505: CandListData_GrowCacheStop

Provider: Microsoft-Windows-TSF-UIManager
Channel: UIManager_Channel
Task: CandListData_GrowCache
Opcode: Stop

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 4dd778b8-379c-4d8c-b659-517a43d6df7d

Defined in msctfuimanager.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Microsoft-Windows-TSF-UIManager registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-TSF-UIManager registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)