Microsoft-Windows-VAN

17 events across 1 channel

Event	Title	Channel
8001	InitStart	Diagnostic
8002	InitStop	Diagnostic
8005	ShowFlyoutFromTrayStart	Diagnostic
8006	ShowFlyoutFromTrayStop	Diagnostic
8007	ShowCFEStart	Diagnostic
8008	ShowCFEStop	Diagnostic
8009	DisconnectStart	Diagnostic
8010	DisconnectStop	Diagnostic
8012	CFE Connection Flow Completed	Diagnostic
8013	Network Status set to Limited	Diagnostic
8014	Network Status set to Connected	Diagnostic
8015	LoadPreCFEStart	Diagnostic
8016	LoadPreCFEStop	Diagnostic
8017	ExpandNetworkStart	Diagnostic
8018	ExpandNetworkStop	Diagnostic
8019	DisplayContextMenuStart	Diagnostic
8020	DisplayContextMenuStop	Diagnostic

Event ID 8001: InitStart

Provider: Microsoft-Windows-VAN
Channel: Diagnostic
Task: Init
Opcode: Start

Event ID 8002: InitStop

Provider: Microsoft-Windows-VAN
Channel: Diagnostic
Task: Init
Opcode: Stop

Event ID 8005: ShowFlyoutFromTrayStart

Provider: Microsoft-Windows-VAN
Channel: Diagnostic
Task: ShowFlyoutFromTray
Opcode: Start

Event ID 8006: ShowFlyoutFromTrayStop

Provider: Microsoft-Windows-VAN
Channel: Diagnostic
Task: ShowFlyoutFromTray
Opcode: Stop

Event ID 8007: ShowCFEStart

Provider: Microsoft-Windows-VAN
Channel: Diagnostic
Task: ShowCFE
Opcode: Start

Event ID 8008: ShowCFEStop

Provider: Microsoft-Windows-VAN
Channel: Diagnostic
Task: ShowCFE
Opcode: Stop

Event ID 8009: DisconnectStart

Provider: Microsoft-Windows-VAN
Channel: Diagnostic
Task: Disconnect
Opcode: Start

Event ID 8010: DisconnectStop

Provider: Microsoft-Windows-VAN
Channel: Diagnostic
Task: Disconnect
Opcode: Stop

Event ID 8012: CFE Connection Flow Completed

Provider: Microsoft-Windows-VAN
Channel: Diagnostic
Task: CFEConnectFlowFinished
Opcode: Info

Description

CFE Connection Flow Completed.

Message #

CFE Connection Flow Completed

Event ID 8013: Network Status set to Limited

Provider: Microsoft-Windows-VAN
Channel: Diagnostic
Task: NetworkStatus_Limited
Opcode: Info

Description

Network Status set to Limited.

Message #

Network Status set to Limited

Event ID 8014: Network Status set to Connected

Provider: Microsoft-Windows-VAN
Channel: Diagnostic
Task: NetworkStatus_Connected
Opcode: Info

Description

Network Status set to Connected.

Message #

Network Status set to Connected

Event ID 8015: LoadPreCFEStart

Provider: Microsoft-Windows-VAN
Channel: Diagnostic
Task: LoadPreCFE
Opcode: Start

Event ID 8016: LoadPreCFEStop

Provider: Microsoft-Windows-VAN
Channel: Diagnostic
Task: LoadPreCFE
Opcode: Stop

Event ID 8017: ExpandNetworkStart

Provider: Microsoft-Windows-VAN
Channel: Diagnostic
Task: ExpandNetwork
Opcode: Start

Event ID 8018: ExpandNetworkStop

Provider: Microsoft-Windows-VAN
Channel: Diagnostic
Task: ExpandNetwork
Opcode: Stop

Event ID 8019: DisplayContextMenuStart

Provider: Microsoft-Windows-VAN
Channel: Diagnostic
Task: DisplayContextMenu
Opcode: Start

Event ID 8020: DisplayContextMenuStop

Provider: Microsoft-Windows-VAN
Channel: Diagnostic
Task: DisplayContextMenu
Opcode: Stop

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 01578f96-c270-4602-ade0-578d9c29fc0c

Defined in van.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02

Downloads

Microsoft-Windows-VAN registered manifest XML (WS2022-20348.4893) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-VAN

Event ID 8001: InitStart

Event ID 8002: InitStop

Event ID 8005: ShowFlyoutFromTrayStart

Event ID 8006: ShowFlyoutFromTrayStop

Event ID 8007: ShowCFEStart

Event ID 8008: ShowCFEStop

Event ID 8009: DisconnectStart

Event ID 8010: DisconnectStop

Event ID 8012: CFE Connection Flow Completed

Description

Message #

Event ID 8013: Network Status set to Limited

Description

Message #

Event ID 8014: Network Status set to Connected

Description

Message #

Event ID 8015: LoadPreCFEStart

Event ID 8016: LoadPreCFEStop

Event ID 8017: ExpandNetworkStart

Event ID 8018: ExpandNetworkStop

Event ID 8019: DisplayContextMenuStart

Event ID 8020: DisplayContextMenuStop

Provenance

Downloads

Credits

Keyboard shortcuts

Search operators