Microsoft-Windows-Containers-CCG

Event	Title	Channel	Sample	Rule
1	Container Credential Guard instantiated the plugin: First.	Admin	N	N
1	Event ID 1	Operational	N	N
2	Container Credential Guard fetched gmsa credentials for First using plugin: …	Admin	N	N
2	Event ID 2	Operational	N	N
3	Container Credential Guard failed to parse the credential spec.	Admin	N	N
3	Event ID 3	Operational	N	N
4	Container Credential Guard failed to instantiate the plugin: First.	Admin	N	N
4	Event ID 4	Operational	N	N
5	Container Credential Guard failed to initialize the plugin: First.	Admin	N	N
6	Container Credential Guard failed to fetch credentials from the plugin: First.	Admin	N	N
6	Event ID 6	Operational	N	N
7	Container Credential Guard is refetching the credentials using the plugin: …	Admin	N	N
7	Event ID 7	Operational	N	N
8	Container Credential Guard failed to fetch gmsa credentials for First using …	Admin	N	N
8	Event ID 8	Operational	N	N
9	Container Credential Guard failed to parse the plugin GUID in the credential …	Admin	N	N

Event ID 1: Container Credential Guard instantiated the plugin: First.

Channel: Admin
Task: Plugin
Opcode: Success

Message #

Container Credential Guard instantiated the plugin: %1.

Fields #

Name	Description
`First` UnicodeString

Event ID 1

Channel: Operational
Task: Plugin
Opcode: Success

Description

Container Credential Guard instantiated the plugin: .

Fields #

Name	Description
`First` UnicodeString

Event ID 2: Container Credential Guard fetched gmsa credentials for First using plugin: Second.

Channel: Admin
Task: CCG
Opcode: Success

Message #

Container Credential Guard fetched gmsa credentials for %1 using plugin: %2.

Fields #

Name	Description
`First` UnicodeString
`Second` UnicodeString

Event ID 2

Channel: Operational
Task: CCG
Opcode: Success

Description

Container Credential Guard fetched gmsa credentials for using plugin: .

Fields #

Name	Description
`First` UnicodeString
`Second` UnicodeString

Event ID 3: Container Credential Guard failed to parse the credential spec.

Channel: Admin
Task: CCG
Opcode: Failed

Description

Container Credential Guard failed to parse the credential spec. Error: error.

Message #

Container Credential Guard failed to parse the credential spec. Error: %1

Fields #

Name	Description
`error` UInt32

Event ID 3

Channel: Operational
Task: CCG
Opcode: Failed

Description

Container Credential Guard failed to parse the credential spec. Error.

Fields #

Name	Description
`error` UInt32

Event ID 4: Container Credential Guard failed to instantiate the plugin: First.

Channel: Admin
Task: Plugin
Opcode: Failed

Description

Container Credential Guard failed to instantiate the plugin: First. Error: Second.

Message #

Container Credential Guard failed to instantiate the plugin: %1. Error: %2

Fields #

Name	Description
`First` UnicodeString
`Second` Int32

Event ID 4

Channel: Operational
Task: Plugin
Opcode: Failed

Description

Container Credential Guard failed to instantiate the plugin: . Error.

Fields #

Name	Description
`First` UnicodeString
`Second` Int32

Event ID 5: Container Credential Guard failed to initialize the plugin: First.

Channel: Admin
Task: Plugin
Opcode: Failed

Message #

Container Credential Guard failed to initialize the plugin: %1. Error: %2

Fields #

Name	Description
`First` UnicodeString → string
`Second` Int32 → Hresult

Event ID 6: Container Credential Guard failed to fetch credentials from the plugin: First.

Channel: Admin
Task: Plugin
Opcode: Failed

Description

Container Credential Guard failed to fetch credentials from the plugin: First. Error: Second.

Message #

Container Credential Guard failed to fetch credentials from the plugin: %1. Error: %2

Fields #

Name	Description
`First` UnicodeString
`Second` Int32

Event ID 6

Channel: Operational
Task: Plugin
Opcode: Failed

Description

Container Credential Guard failed to fetch credentials from the plugin: . Error.

Fields #

Name	Description
`First` UnicodeString
`Second` Int32

Event ID 7: Container Credential Guard is refetching the credentials using the plugin: First.

Channel: Admin
Task: Plugin
Opcode: Success

Message #

Container Credential Guard is refetching the credentials using the plugin: %1.

Fields #

Name	Description
`First` UnicodeString

Event ID 7

Channel: Operational
Task: Plugin
Opcode: Success

Description

Container Credential Guard is refetching the credentials using the plugin: .

Fields #

Name	Description
`First` UnicodeString

Event ID 8: Container Credential Guard failed to fetch gmsa credentials for First using plugin Second.

Channel: Admin
Task: CCG
Opcode: Failed

Description

Container Credential Guard failed to fetch gmsa credentials for First using plugin Second. Error reason: Third.

Message #

Container Credential Guard failed to fetch gmsa credentials for %1 using plugin %2. Error reason: %3

Fields #

Name	Description
`First` UnicodeString
`Second` UnicodeString
`Third` UnicodeString

Event ID 8

Channel: Operational
Task: CCG
Opcode: Failed

Description

Container Credential Guard failed to fetch gmsa credentials for using plugin . Error reason.

Fields #

Name	Description
`First` UnicodeString
`Second` UnicodeString
`Third` UnicodeString

Event ID 9: Container Credential Guard failed to parse the plugin GUID in the credential spec.

Channel: Admin
Task: CCG
Opcode: Failed

Message #

Container Credential Guard failed to parse the plugin GUID in the credential spec. Error: %1

Fields #

Name	Description
`First` Int32 → Hresult