Microsoft-Windows-WABSyncProvider

22 events across 1 channel

Event	Title	Channel
3	InitializePropertyMapStart	Analytic
4	InitializePropertyMapStop	Analytic
5	GetIdParameterStart	Analytic
6	GetIdParameterStop	Analytic
7	BeginSessionStart	Analytic
8	BeginSessionStop	Analytic
9	EndSessionStart	Analytic
10	EndSessionStop	Analytic
11	GetMetadataStoreStart	Analytic
12	GetMetadataStoreStop	Analytic
13	GetMetadataSchemaStart	Analytic
14	GetMetadataSchemaStop	Analytic
15	EnumerateItemsStart	Analytic
16	EnumerateItemsStop	Analytic
17	LoadChangeDataStart	Analytic
18	LoadChangeDataStop	Analytic
19	InsertItemStart	Analytic
20	InsertItemStop	Analytic
21	UpdateItemStart	Analytic
22	UpdateItemStop	Analytic
23	DeleteItemStart	Analytic
24	DeleteItemStop	Analytic

Event ID 3: InitializePropertyMapStart

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: InitializePropertyMap
Opcode: Start

Event ID 4: InitializePropertyMapStop

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: InitializePropertyMap
Opcode: Stop

Event ID 5: GetIdParameterStart

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: GetIdParameter
Opcode: Start

Event ID 6: GetIdParameterStop

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: GetIdParameter
Opcode: Stop

Event ID 7: BeginSessionStart

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: BeginSession
Opcode: Start

Event ID 8: BeginSessionStop

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: BeginSession
Opcode: Stop

Event ID 9: EndSessionStart

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: EndSession
Opcode: Start

Event ID 10: EndSessionStop

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: EndSession
Opcode: Stop

Event ID 11: GetMetadataStoreStart

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: GetMetadataStore
Opcode: Start

Event ID 12: GetMetadataStoreStop

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: GetMetadataStore
Opcode: Stop

Event ID 13: GetMetadataSchemaStart

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: GetMetadataSchema
Opcode: Start

Event ID 14: GetMetadataSchemaStop

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: GetMetadataSchema
Opcode: Stop

Event ID 15: EnumerateItemsStart

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: EnumerateItems
Opcode: Start

Event ID 16: EnumerateItemsStop

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: EnumerateItems
Opcode: Stop

Event ID 17: LoadChangeDataStart

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: LoadChangeData
Opcode: Start

Event ID 18: LoadChangeDataStop

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: LoadChangeData
Opcode: Stop

Event ID 19: InsertItemStart

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: InsertItem
Opcode: Start

Event ID 20: InsertItemStop

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: InsertItem
Opcode: Stop

Event ID 21: UpdateItemStart

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: UpdateItem
Opcode: Start

Event ID 22: UpdateItemStop

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: UpdateItem
Opcode: Stop

Event ID 23: DeleteItemStart

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: DeleteItem
Opcode: Start

Event ID 24: DeleteItemStop

Provider: Microsoft-Windows-WABSyncProvider
Channel: Analytic
Task: DeleteItem
Opcode: Stop

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 17f14a23-551d-40cc-a086-e4194d64ed4c

Defined in WABSyncProvider.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Microsoft-Windows-WABSyncProvider registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-WABSyncProvider registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)