Microsoft-Windows-Diagnosis-AdvancedTaskManager

134 events across 2 channels

Event	Title	Channel	Sample
5016	task_0	Operational	N
5017	task_05017	Operational	N
5018	task_05018	Operational	N
5100	ListUpdate	Operational	N
5101	ListUpdateInsert	Operational	N
5102	ListUpdateDelete	Operational	N
5103	task_05103	Operational	N
5200	PerfTrack_TM8_LaunchStart	Analytic	N
5201	PerfTrack_TM8_LaunchStop	Analytic	N
5202	PerfTrack_TM8_TabSwitchStart	Analytic	N
5203	PerfTrack_TM8_TabSwitchStop	Analytic	N
5204	PerfTrack_TM8_KillProcessStart	Analytic	N
5205	PerfTrack_TM8_KillProcessStop	Analytic	N
5301	TM8_Window_LaunchStart	Operational	N
5302	TM8_Window_LaunchStop	Operational	N
5303	Monitor_SetupStart	Operational	N
5304	Monitor_SetupStop	Operational	N
5351	Dashboard_SetupStart	Operational	N
5352	Dashboard_SetupStop	Operational	N
5353	Dashboard_Sidebar_InitStart	Operational	N
5354	Dashboard_Sidebar_InitStop	Operational	N
5355	Dashboard_Sidebar_CPU_InitStart	Operational	N
5356	Dashboard_Sidebar_CPU_InitStop	Operational	N
5357	Dashboard_Sidebar_Memory_InitStart	Operational	N
5358	Dashboard_Sidebar_Memory_InitStop	Operational	N
5359	Dashboard_Sidebar_Disk_InitStart	Operational	N
5360	Dashboard_Sidebar_Disk_InitStop	Operational	N
5361	Dashboard_Sidebar_Network_InitStart	Operational	N
5362	Dashboard_Sidebar_Network_InitStop	Operational	N
5363	Dashboard_LoadPageTemplateStart	Operational	N
5364	Dashboard_LoadPageTemplateStop	Operational	N
5365	Dashboard_CPUView_InitStart	Operational	N
5366	Dashboard_CPUView_InitStop	Operational	N
5367	Dashboard_MemoryView_InitStart	Operational	N
5368	Dashboard_MemoryView_InitStop	Operational	N
5369	Dashboard_DiskView_InitStart	Operational	N
5370	Dashboard_DiskView_InitStop	Operational	N
5371	Dashboard_NetworkView_InitStart	Operational	N
5372	Dashboard_NetworkView_InitStop	Operational	N
5373	Dashboard_RenderStart	Operational	N
5374	Dashboard_RenderStop	Operational	N
5375	Dashboard_SwitchResourceStart	Operational	N
5376	Dashboard_SwitchResourceStop	Operational	N
5379	Dashboard_Disk_EnumerateDisksStart	Operational	N
5380	Dashboard_Disk_EnumerateDisksStop	Operational	N
5381	Dashboard_Network_Adapter_EnumerateAdaptersStart	Operational	N
5382	Dashboard_Network_Adapter_EnumerateAdaptersStop	Operational	N
5383	Dashboard_Network_Adapter_RefreshAdaptersStart	Operational	N
5384	Dashboard_Network_Adapter_RefreshAdaptersStop	Operational	N
5385	Dashboard_Network_Adapter_WifiSetPropertiesStart	Operational	N
5386	Dashboard_Network_Adapter_WifiSetPropertiesStop	Operational	N
5387	Dashboard_Network_Adapter_WWanSetPropertiesStart	Operational	N
5388	Dashboard_Network_Adapter_WWanSetPropertiesStop	Operational	N
5389	Dashboard_ChangeSummaryViewStart	Operational	N
5390	Dashboard_ChangeSummaryViewStop	Operational	N
5391	Dashboard_TurnChartsOnOffStart	Operational	N
5392	Dashboard_TurnChartsOnOffStop	Operational	N
5393	Dashboard_AddDiskStart	Operational	N
5394	Dashboard_AddDiskStop	Operational	N
5395	Dashboard_RemoveDiskStart	Operational	N
5396	Dashboard_RemoveDiskStop	Operational	N
5397	Dashboard_AddAdapterStart	Operational	N
5398	Dashboard_AddAdapterStop	Operational	N
5399	Dashboard_RemoveAdapterStart	Operational	N
5400	Dashboard_RemoveAdapterStop	Operational	N
5401	Dashboard_DiskPerfIOCTLStart	Operational	N
5402	Dashboard_DiskPerfIOCTLStop	Operational	N
5403	Dashboard_ChartScaleChangedUpdate	Operational	N
5404	Dashboard_DiskLengthIOCTLStart	Operational	N
5405	Dashboard_DiskLengthIOCTLStop	Operational	N
5501	UI_RenderStart	Operational	N
5502	UI_RenderStop	Operational	N
5503	UI_DataSortStart	Operational	N
5504	UI_DataSortStop	Operational	N
5505	UI_ClickExpandoStart	Operational	N
5506	UI_ClickExpandoStop	Operational	N
5651	DataMonitor_AppInfo_UpdateStart	Operational	N
5652	DataMonitor_AppInfo_UpdateStop	Operational	N
5653	DataMonitor_WindowInfo_UpdateStart	Operational	N
5654	DataMonitor_WindowInfo_UpdateStop	Operational	N
5655	DataMonitor_AppServiceInfo_UpdateStart	Operational	N
5656	DataMonitor_AppServiceInfo_UpdateStop	Operational	N
5657	DataMonitor_TrayIconInfo_UpdateStart	Operational	N
5658	DataMonitor_TrayIconInfo_UpdateStop	Operational	N
5659	DataMonitor_UserInfo_UpdateStart	Operational	N
5660	DataMonitor_UserInfo_UpdateStop	Operational	N
6001	Actions_InvokeMenuStart	Operational	N
6002	Actions_InvokeMenuStop	Operational	N
6003	Actions_RightClickPopupStart	Operational	N
6004	Actions_RightClickPopupStop	Operational	N
6005	Actions_EndTask_ProcessStart	Operational	N
6006	Actions_EndTask_ProcessStop	Operational	N
6007	Actions_EndTask_WindowStart	Operational	N
6008	Actions_EndTask_WindowStop	Operational	N
6009	Actions_EndTask_ServiceStart	Operational	N
6010	Actions_EndTask_ServiceStop	Operational	N
6011	Actions_SortbyStart	Operational	N
6012	Actions_SortbyStop	Operational	N
6013	Actions_SortDUITreeStart	Operational	N
6014	Actions_SortDUITreeStop	Operational	N
6015	Actions_ColSwapStart	Operational	N
6016	Actions_ColSwapStop	Operational	N
6017	Actions_ColResizeStart	Operational	N
6018	Actions_ColResizeStop	Operational	N
6019	Actions_ChangeViewStart	Operational	N
6020	Actions_ChangeViewStop	Operational	N
6021	Monitor_ChangeViewStart	Operational	N
6022	Monitor_ChangeViewStop	Operational	N
6023	Actions_ConfirmCommandStart	Operational	N
6024	Actions_ConfirmCommandStop	Operational	N
6025	Actions_SwitchUser	Operational	N
6026	Actions_SendMessage	Operational	N
6027	Actions_LogoffUser	Operational	N
6028	Actions_DisconnectUser	Operational	N
7000	Startup_ImpactFile_ParseStart	Operational	N
7001	Startup_ImpactFile_ParseStop	Operational	N
7002	Startup_EnumerationStart	Operational	N
7003	Startup_EnumerationStop	Operational	N
7004	Startup_LoadItemsStart	Operational	N
7005	Startup_LoadItemsStop	Operational	N
7100	AppHistory_EnumerateInstalledAppsStart	Operational	N
7101	AppHistory_EnumerateInstalledAppsStop	Operational	N
7102	AppHistory_RegisterAndProcessStatsStart	Operational	N
7103	AppHistory_RegisterAndProcessStatsStop	Operational	N
7104	AppHistory_GetInterfaceCostStart	Operational	N
7105	AppHistory_GetInterfaceCostStop	Operational	N
7106	AppHistory_ParsePackageIconStart	Operational	N
7107	AppHistory_ParsePackageIconStop	Operational	N
7108	AppHistory_AddImmersiveApplicationStart	Operational	N
7109	AppHistory_AddImmersiveApplicationStop	Operational	N
7110	AppHistory_AddDesktopApplicationStart	Operational	N
7111	AppHistory_AddDesktopApplicationStop	Operational	N
7112	AppHistory_ProcessSrumRecordSetStart	Operational	N
7113	AppHistory_ProcessSrumRecordSetStop	Operational	N

Event ID 5016: task_0

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Opcode: Info

Fields #

Name	Description
`FileName` AnsiString
`Line` UInt32
`Address` Pointer
`Size` Pointer

Event ID 5017: task_05017

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Opcode: Info

Fields #

Name	Description
`FileName` AnsiString
`Line` UInt32
`Address` Pointer

Event ID 5018: task_05018

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Opcode: Info

Fields #

Name	Description
`FileName` AnsiString
`Line` UInt32
`Address` Pointer
`Size` Pointer
`OrigAddress` Pointer

Event ID 5100: ListUpdate

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: ListUpdate
Opcode: Update

Fields #

Name	Description
`TableId` UInt32
`ItemPos` UInt32
`ItemState` UInt32
`ItemContent` UnicodeString

Event ID 5101: ListUpdateInsert

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: ListUpdate
Opcode: Insert

Fields #

Name	Description
`TableId` UInt32
`ItemPos` UInt32
`ItemState` UInt32
`ItemContent` UnicodeString

Event ID 5102: ListUpdateDelete

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: ListUpdate
Opcode: Delete

Fields #

Name	Description
`TableId` UInt32
`ItemPos` UInt32
`ItemState` UInt32
`ItemContent` UnicodeString

Event ID 5103: task_05103

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Opcode: Info

Fields #

Name	Description
`FileName` AnsiString
`Function` AnsiString
`Line` UInt32
`ErrorText` UnicodeString

Event ID 5200: PerfTrack_TM8_LaunchStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Analytic
Task: PerfTrack_TM8_Launch
Opcode: Start

Event ID 5201: PerfTrack_TM8_LaunchStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Analytic
Task: PerfTrack_TM8_Launch
Opcode: Stop

Event ID 5202: PerfTrack_TM8_TabSwitchStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Analytic
Task: PerfTrack_TM8_TabSwitch
Opcode: Start

Fields #

Name	Description
`TabId` UInt32

Event ID 5203: PerfTrack_TM8_TabSwitchStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Analytic
Task: PerfTrack_TM8_TabSwitch
Opcode: Stop

Fields #

Name	Description
`TabId` UInt32

Event ID 5204: PerfTrack_TM8_KillProcessStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Analytic
Task: PerfTrack_TM8_KillProcess
Opcode: Start

Fields #

Name	Description
`ProcessOrPackageName` UnicodeString
`Version` UnicodeString
`TimeDateStamp` UInt32
`ProcessId` UInt32

Event ID 5205: PerfTrack_TM8_KillProcessStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Analytic
Task: PerfTrack_TM8_KillProcess
Opcode: Stop

Fields #

Name	Description
`ProcessOrPackageName` UnicodeString
`Version` UnicodeString
`TimeDateStamp` UInt32
`ProcessId` UInt32

Event ID 5301: TM8_Window_LaunchStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: TM8_Window_Launch
Opcode: Start

Event ID 5302: TM8_Window_LaunchStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: TM8_Window_Launch
Opcode: Stop

Event ID 5303: Monitor_SetupStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Monitor_Setup
Opcode: Start

Event ID 5304: Monitor_SetupStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Monitor_Setup
Opcode: Stop

Event ID 5351: Dashboard_SetupStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Setup
Opcode: Start

Event ID 5352: Dashboard_SetupStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Setup
Opcode: Stop

Event ID 5353: Dashboard_Sidebar_InitStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_Init
Opcode: Start

Event ID 5354: Dashboard_Sidebar_InitStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_Init
Opcode: Stop

Event ID 5355: Dashboard_Sidebar_CPU_InitStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_CPU_Init
Opcode: Start

Event ID 5356: Dashboard_Sidebar_CPU_InitStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_CPU_Init
Opcode: Stop

Event ID 5357: Dashboard_Sidebar_Memory_InitStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_Memory_Init
Opcode: Start

Event ID 5358: Dashboard_Sidebar_Memory_InitStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_Memory_Init
Opcode: Stop

Event ID 5359: Dashboard_Sidebar_Disk_InitStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_Disk_Init
Opcode: Start

Event ID 5360: Dashboard_Sidebar_Disk_InitStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_Disk_Init
Opcode: Stop

Event ID 5361: Dashboard_Sidebar_Network_InitStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_Network_Init
Opcode: Start

Event ID 5362: Dashboard_Sidebar_Network_InitStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_Network_Init
Opcode: Stop

Event ID 5363: Dashboard_LoadPageTemplateStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_LoadPageTemplate
Opcode: Start

Fields #

Name	Description
`PageId` UInt32

Event ID 5364: Dashboard_LoadPageTemplateStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_LoadPageTemplate
Opcode: Stop

Fields #

Name	Description
`PageId` UInt32

Event ID 5365: Dashboard_CPUView_InitStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_CPUView_Init
Opcode: Start

Event ID 5366: Dashboard_CPUView_InitStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_CPUView_Init
Opcode: Stop

Fields #

Name	Description
`ResourceName` UnicodeString
`ProcessorCoreCount` UInt32
`LogicalProcessorCount` UInt32
`NumaNodeCount` UInt32
`MaxCPUSpeed` UnicodeString
`CurrentCPUSpeed` UnicodeString
`Virtualization` UnicodeString

Event ID 5367: Dashboard_MemoryView_InitStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_MemoryView_Init
Opcode: Start

Event ID 5368: Dashboard_MemoryView_InitStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_MemoryView_Init
Opcode: Stop

Fields #

Name	Description
`ResourceName` UnicodeString
`MemorySpeed` UnicodeString
`SlotsUsed` UnicodeString
`AvailableMemory` UnicodeString
`CachedMemory` UnicodeString
`CommittedMemory` UnicodeString

Event ID 5369: Dashboard_DiskView_InitStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_DiskView_Init
Opcode: Start

Event ID 5370: Dashboard_DiskView_InitStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_DiskView_Init
Opcode: Stop

Event ID 5371: Dashboard_NetworkView_InitStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_NetworkView_Init
Opcode: Start

Event ID 5372: Dashboard_NetworkView_InitStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_NetworkView_Init
Opcode: Stop

Event ID 5373: Dashboard_RenderStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Render
Opcode: Start

Fields #

Name	Description
`PageId` UInt32

Event ID 5374: Dashboard_RenderStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Render
Opcode: Stop

Fields #

Name	Description
`PageId` UInt32

Event ID 5375: Dashboard_SwitchResourceStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_SwitchResource
Opcode: Start

Event ID 5376: Dashboard_SwitchResourceStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_SwitchResource
Opcode: Stop

Fields #

Name	Description
`OldPageId` UInt32
`NewPageId` UInt32

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5376
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5376

Event ID 5379: Dashboard_Disk_EnumerateDisksStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Disk_EnumerateDisks
Opcode: Start

Event ID 5380: Dashboard_Disk_EnumerateDisksStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Disk_EnumerateDisks
Opcode: Stop

Fields #

Name	Description
`DiskCount` UInt32

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5380

Event ID 5381: Dashboard_Network_Adapter_EnumerateAdaptersStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Network_Adapter_EnumerateAdapters
Opcode: Start

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5381

Event ID 5382: Dashboard_Network_Adapter_EnumerateAdaptersStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Network_Adapter_EnumerateAdapters
Opcode: Stop

Fields #

Name	Description
`AdapterCount` UInt32

Event ID 5383: Dashboard_Network_Adapter_RefreshAdaptersStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Network_Adapter_RefreshAdapters
Opcode: Start

Event ID 5384: Dashboard_Network_Adapter_RefreshAdaptersStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Network_Adapter_RefreshAdapters
Opcode: Stop

Fields #

Name	Description
`AdapterCount` UInt32

Event ID 5385: Dashboard_Network_Adapter_WifiSetPropertiesStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Network_Adapter_WifiSetProperties
Opcode: Start

Event ID 5386: Dashboard_Network_Adapter_WifiSetPropertiesStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Network_Adapter_WifiSetProperties
Opcode: Stop

Fields #

Name	Description
`SSID` UnicodeString
`PhysicalNetworkType` UnicodeString
`SignalQuality` UInt32

Event ID 5387: Dashboard_Network_Adapter_WWanSetPropertiesStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Network_Adapter_WWanSetProperties
Opcode: Start

Event ID 5388: Dashboard_Network_Adapter_WWanSetPropertiesStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Network_Adapter_WWanSetProperties
Opcode: Stop

Fields #

Name	Description
`ServiceProvider` UnicodeString
`PhysicalNetworkType` UnicodeString
`SignalQuality` UInt32

Event ID 5389: Dashboard_ChangeSummaryViewStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_ChangeSummaryView
Opcode: Start

Fields #

Name	Description
`Snap` UInt32
`CurrentView` UInt32

Event ID 5390: Dashboard_ChangeSummaryViewStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_ChangeSummaryView
Opcode: Stop

Event ID 5391: Dashboard_TurnChartsOnOffStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_TurnChartsOnOff
Opcode: Start

Fields #

Name	Description
`ChartsOn` UInt32
`CurrentView` UInt32

Event ID 5392: Dashboard_TurnChartsOnOffStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_TurnChartsOnOff
Opcode: Stop

Event ID 5393: Dashboard_AddDiskStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_AddDisk
Opcode: Start

Fields #

Name	Description
`OldCount` UInt32
`NewCount` UInt32

Event ID 5394: Dashboard_AddDiskStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_AddDisk
Opcode: Stop

Event ID 5395: Dashboard_RemoveDiskStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_RemoveDisk
Opcode: Start

Fields #

Name	Description
`OldCount` UInt32
`NewCount` UInt32

Event ID 5396: Dashboard_RemoveDiskStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_RemoveDisk
Opcode: Stop

Event ID 5397: Dashboard_AddAdapterStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_AddAdapter
Opcode: Start

Fields #

Name	Description
`OldCount` UInt32
`NewCount` UInt32

Event ID 5398: Dashboard_AddAdapterStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_AddAdapter
Opcode: Stop

Event ID 5399: Dashboard_RemoveAdapterStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_RemoveAdapter
Opcode: Start

Fields #

Name	Description
`OldCount` UInt32
`NewCount` UInt32

Event ID 5400: Dashboard_RemoveAdapterStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_RemoveAdapter
Opcode: Stop

Event ID 5401: Dashboard_DiskPerfIOCTLStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_DiskPerfIOCTL
Opcode: Start

Fields #

Name	Description
`DiskNumber` UInt32

Event ID 5402: Dashboard_DiskPerfIOCTLStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_DiskPerfIOCTL
Opcode: Stop

Fields #

Name	Description
`Hresult` UInt32
`QueryByteReturned` UInt32

Event ID 5403: Dashboard_ChartScaleChangedUpdate

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_ChartScaleChanged
Opcode: Update

Fields #

Name	Description
`ChartId` UnicodeString
`FromScaleIndex` UInt32
`FromScaleString` UnicodeString
`ToScaleIndex` UInt32
`ToScaleString` UnicodeString

Event ID 5404: Dashboard_DiskLengthIOCTLStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_DiskLengthIOCTL
Opcode: Start

Fields #

Name	Description
`DiskNumber` UInt32

Event ID 5405: Dashboard_DiskLengthIOCTLStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_DiskLengthIOCTL
Opcode: Stop

Fields #

Name	Description
`Hresult` UInt32
`QueryByteReturned` UInt32
`LengthInByte` UInt64

Event ID 5501: UI_RenderStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: UI_Render
Opcode: Start

Fields #

Name	Description
`TabId` UInt32

Event ID 5502: UI_RenderStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: UI_Render
Opcode: Stop

Fields #

Name	Description
`TabId` UInt32

Event ID 5503: UI_DataSortStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: UI_DataSort
Opcode: Start

Event ID 5504: UI_DataSortStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: UI_DataSort
Opcode: Stop

Fields #

Name	Description
`PageId` UInt32

Event ID 5505: UI_ClickExpandoStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: UI_ClickExpando
Opcode: Start

Event ID 5506: UI_ClickExpandoStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: UI_ClickExpando
Opcode: Stop

Event ID 5651: DataMonitor_AppInfo_UpdateStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_AppInfo_Update
Opcode: Start

Event ID 5652: DataMonitor_AppInfo_UpdateStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_AppInfo_Update
Opcode: Stop

Fields #

Name	Description
`NewItems` UInt32
`UpdatedItems` UInt32

Event ID 5653: DataMonitor_WindowInfo_UpdateStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_WindowInfo_Update
Opcode: Start

Event ID 5654: DataMonitor_WindowInfo_UpdateStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_WindowInfo_Update
Opcode: Stop

Fields #

Name	Description
`NewItems` UInt32
`UpdatedItems` UInt32

Event ID 5655: DataMonitor_AppServiceInfo_UpdateStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_AppServiceInfo_Update
Opcode: Start

Event ID 5656: DataMonitor_AppServiceInfo_UpdateStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_AppServiceInfo_Update
Opcode: Stop

Fields #

Name	Description
`NewItems` UInt32
`UpdatedItems` UInt32

Event ID 5657: DataMonitor_TrayIconInfo_UpdateStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_TrayIconInfo_Update
Opcode: Start

Event ID 5658: DataMonitor_TrayIconInfo_UpdateStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_TrayIconInfo_Update
Opcode: Stop

Fields #

Name	Description
`NewItems` UInt32
`UpdatedItems` UInt32

Event ID 5659: DataMonitor_UserInfo_UpdateStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_UserInfo_Update
Opcode: Start

Event ID 5660: DataMonitor_UserInfo_UpdateStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_UserInfo_Update
Opcode: Stop

Fields #

Name	Description
`NewItems` UInt32
`UpdatedItems` UInt32

Event ID 6001: Actions_InvokeMenuStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_InvokeMenu
Opcode: Start

Event ID 6002: Actions_InvokeMenuStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_InvokeMenu
Opcode: Stop

Fields #

Name	Description
`ItemType` UInt64
`MenuId` UInt32

Event ID 6003: Actions_RightClickPopupStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_RightClickPopup
Opcode: Start

Event ID 6004: Actions_RightClickPopupStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_RightClickPopup
Opcode: Stop

Fields #

Name	Description
`ItemType` UInt64

Event ID 6005: Actions_EndTask_ProcessStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_EndTask_Process
Opcode: Start

Fields #

Name	Description
`ProcessId` UInt32

Event ID 6006: Actions_EndTask_ProcessStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_EndTask_Process
Opcode: Stop

Fields #

Name	Description
`ProcessId` UInt32

Event ID 6007: Actions_EndTask_WindowStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_EndTask_Window
Opcode: Start

Fields #

Name	Description
`WindowHandle` UInt32

Event ID 6008: Actions_EndTask_WindowStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_EndTask_Window
Opcode: Stop

Fields #

Name	Description
`WindowHandle` UInt32

Event ID 6009: Actions_EndTask_ServiceStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_EndTask_Service
Opcode: Start

Fields #

Name	Description
`ServiceName` UnicodeString

Event ID 6010: Actions_EndTask_ServiceStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_EndTask_Service
Opcode: Stop

Fields #

Name	Description
`ServiceName` UnicodeString

Event ID 6011: Actions_SortbyStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_Sortby
Opcode: Start

Event ID 6012: Actions_SortbyStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_Sortby
Opcode: Stop

Event ID 6013: Actions_SortDUITreeStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_SortDUITree
Opcode: Start

Event ID 6014: Actions_SortDUITreeStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_SortDUITree
Opcode: Stop

Event ID 6015: Actions_ColSwapStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_ColSwap
Opcode: Start

Event ID 6016: Actions_ColSwapStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_ColSwap
Opcode: Stop

Event ID 6017: Actions_ColResizeStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_ColResize
Opcode: Start

Event ID 6018: Actions_ColResizeStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_ColResize
Opcode: Stop

Event ID 6019: Actions_ChangeViewStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_ChangeView
Opcode: Start

Fields #

Name	Description
`FromTab` UInt32
`ToTab` UInt32

Event ID 6020: Actions_ChangeViewStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_ChangeView
Opcode: Stop

Event ID 6021: Monitor_ChangeViewStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Monitor_ChangeView
Opcode: Start

Fields #

Name	Description
`FromTab` UInt32
`ToTab` UInt32

Event ID 6022: Monitor_ChangeViewStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Monitor_ChangeView
Opcode: Stop

Event ID 6023: Actions_ConfirmCommandStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_ConfirmCommand
Opcode: Start

Fields #

Name	Description
`CommandId` UInt32

Event ID 6024: Actions_ConfirmCommandStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_ConfirmCommand
Opcode: Stop

Event ID 6025: Actions_SwitchUser

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_SwitchUser

Event ID 6026: Actions_SendMessage

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_SendMessage

Event ID 6027: Actions_LogoffUser

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_LogoffUser

Event ID 6028: Actions_DisconnectUser

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_DisconnectUser

Event ID 7000: Startup_ImpactFile_ParseStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Startup_ImpactFile_Parse
Opcode: Start

Event ID 7001: Startup_ImpactFile_ParseStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Startup_ImpactFile_Parse
Opcode: Stop

Fields #

Name	Description
`CountOfItemsInStartupXML` UInt32

Event ID 7002: Startup_EnumerationStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Startup_Enumeration
Opcode: Start

Event ID 7003: Startup_EnumerationStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Startup_Enumeration
Opcode: Stop

Event ID 7004: Startup_LoadItemsStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Startup_LoadItems
Opcode: Start

Event ID 7005: Startup_LoadItemsStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Startup_LoadItems
Opcode: Stop

Event ID 7100: AppHistory_EnumerateInstalledAppsStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_EnumerateInstalledApps
Opcode: Start

Event ID 7101: AppHistory_EnumerateInstalledAppsStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_EnumerateInstalledApps
Opcode: Stop

Event ID 7102: AppHistory_RegisterAndProcessStatsStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_RegisterAndProcessStats
Opcode: Start

Fields #

Name	Description
`SrumProvider` UInt32

Event ID 7103: AppHistory_RegisterAndProcessStatsStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_RegisterAndProcessStats
Opcode: Stop

Fields #

Name	Description
`SrumProvider` UInt32

Event ID 7104: AppHistory_GetInterfaceCostStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_GetInterfaceCost
Opcode: Start

Fields #

Name	Description
`InterfaceLUID` UInt64
`ProfileIndex` UInt32

Event ID 7105: AppHistory_GetInterfaceCostStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_GetInterfaceCost
Opcode: Stop

Fields #

Name	Description
`InterfaceLUID` UInt64
`ProfileIndex` UInt32

Event ID 7106: AppHistory_ParsePackageIconStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_ParsePackageIcon
Opcode: Start

Fields #

Name	Description
`PackageInstallPath` UnicodeString

Event ID 7107: AppHistory_ParsePackageIconStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_ParsePackageIcon
Opcode: Stop

Fields #

Name	Description
`PackageInstallPath` UnicodeString

Event ID 7108: AppHistory_AddImmersiveApplicationStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_AddImmersiveApplication
Opcode: Start

Event ID 7109: AppHistory_AddImmersiveApplicationStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_AddImmersiveApplication
Opcode: Stop

Fields #

Name	Description
`PackageName` UnicodeString
`LongDisplayName` UnicodeString

Event ID 7110: AppHistory_AddDesktopApplicationStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_AddDesktopApplication
Opcode: Start

Event ID 7111: AppHistory_AddDesktopApplicationStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_AddDesktopApplication
Opcode: Stop

Fields #

Name	Description
`ExePath` UnicodeString

Event ID 7112: AppHistory_ProcessSrumRecordSetStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_ProcessSrumRecordSet
Opcode: Start

Fields #

Name	Description
`SrumProvider` UInt32
`SrumRecordSetCount` UInt64

Event ID 7113: AppHistory_ProcessSrumRecordSetStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_ProcessSrumRecordSet
Opcode: Stop

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 178dadaf-7ac4-4593-ab3e-a45fda6d0d55

Defined in Taskmgr.exe, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)