Microsoft-Windows-Direct3D11

91 events across 3 channels

Event	Title	Channel	Sample
1	Name	Analytic	N
2	NameDCStart	Analytic	N
3	DeviceStart	Analytic	N
4	DeviceStop	Analytic	N
5	DeviceDCStart	Analytic	N
6	BufferStart	Analytic	N
7	BufferStop	Analytic	N
8	BufferDCStart	Analytic	N
9	Texture1DStart	Analytic	N
10	Texture1DStop	Analytic	N
11	Texture1DDCStart	Analytic	N
12	CreateTexture2D	Analytic	N
13	DestroyTexture2D	Analytic	N
14	ReportTexture2D	Analytic	N
15	Texture3DStart	Analytic	N
16	Texture3DStop	Analytic	N
17	Texture3DDCStart	Analytic	N
18	RotateTexture2DIdentities	Analytic	Y
19	Device	Analytic	N
20	D3D11CoreCreateDeviceStart	PerfTiming	N
21	D3D11CoreCreateDeviceStop	PerfTiming	N
22	KMDDeviceCreateStart	PerfTiming	N
23	KMDDeviceCreateStop	PerfTiming	N
24	UMDDeviceCreateStart	PerfTiming	N
25	UMDDeviceCreateStop	PerfTiming	N
26	D3DSupplemental	Logging	N
27	QueryInterface	Logging	N
28	AddRef	Logging	N
29	Release	Logging	N
30	Destruction	Logging	N
31	UMD10CreateDeviceStart	PerfTiming	N
32	UMD10CreateDeviceStop	PerfTiming	N
33	UMDOpenAdapterStart	PerfTiming	N
34	UMDOpenAdapterStop	PerfTiming	N
35	ContextStart	Analytic	N
36	ContextStop	Analytic	N
37	ContextDCStart	Analytic	N
38	Marker	Analytic	N
39	RuntimeMarker	Analytic	N
40	RuntimeDroppedCall	Analytic	N
41	RuntimeMarker41	Analytic	N
42	CommandListStart	Analytic	N
43	CommandListStop	Analytic	N
44	CommandListDCStart	Analytic	N
45	CustomDriverMarker	Analytic	N
46	CustomDriverMarker46	Analytic	N
1714	IDXGIDevice2_OfferResourcesStart	Logging	N
1715	IDXGIDevice2_OfferResourcesStop	Logging	N
1716	IDXGIDevice2_ReclaimResourcesStart	Logging	N
1717	IDXGIDevice2_ReclaimResourcesStop	Logging	N
1720	ID3D11VideoDevice_CreateVideoProcessorStart	Logging	N
1721	ID3D11VideoDevice_CreateVideoProcessorStop	Logging	N
1722	ID3D11VideoDevice_CreateVideoDecoderStart	Logging	N
1723	ID3D11VideoDevice_CreateVideoDecoderStop	Logging	N
1728	ID3D11VideoProcessor_ReleaseStart	Logging	N
1729	ID3D11VideoProcessor_ReleaseStop	Logging	N
1734	ID3D11VideoDecoder_ReleaseStart	Logging	N
1735	ID3D11VideoDecoder_ReleaseStop	Logging	N
1778	ID3D11VideoContext_VideoProcessorBltStart	Logging	N
1779	ID3D11VideoContext_VideoProcessorBltStop	Logging	N
1780	ID3D11VideoContext_GetDecoderBufferStart	Logging	N
1781	ID3D11VideoContext_GetDecoderBufferStop	Logging	N
1784	ID3D11VideoContext_DecoderBeginFrameStart	Logging	N
1785	ID3D11VideoContext_DecoderBeginFrameStop	Logging	N
1786	ID3D11VideoContext_DecoderEndFrameStart	Logging	N
1787	ID3D11VideoContext_DecoderEndFrameStop	Logging	N
1788	ID3D11VideoContext_SubmitDecoderBuffersStart	Logging	N
1789	ID3D11VideoContext_SubmitDecoderBuffersStop	Logging	N
1804	IDXGIDevice3_TrimStart	Analytic	N
1805	IDXGIDevice3_TrimStop	Analytic	N
1806	ID3D11VideoDevice_CreateCryptoSessionStart	Logging	N
1807	ID3D11VideoDevice_CreateCryptoSessionStop	Logging	N
1808	ID3D11VideoContext_NegotiateCryptoSessionKeyExchangeStart	Logging	N
1809	ID3D11VideoContext_NegotiateCryptoSessionKeyExchangeStop	Logging	N
1810	ID3D11VideoContext_VideoProcessorGetBehaviorHintsStart	Logging	N
1811	ID3D11VideoContext_VideoProcessorGetBehaviorHintsStop	Logging	N
1812	CryptoSessionTeardownCount	Logging	N
1813	RecoverTeardown	Logging	N
1814	ID3D11VideoContext_VideoProcessorBltParameters	Logging	N
1815	ID3D11VideoDevice_DestroyCryptoSessionStart	Logging	N
1816	ID3D11VideoDevice_DestroyCryptoSessionStop	Logging	N
1817	ID3D11VideoContext_GetDataForNewHardwareKey	Logging	N
1818	ID3D11VideoContext_SubmitDecoderBuffers1Start	Logging	N
1819	ID3D11VideoContext_SubmitDecoderBuffers1Stop	Logging	N
1820	JournalEntry	Logging	N
1821	IDXGIResource_CreateSharedHandle	Logging	N
1822	ID3D11VideoDevice_NegotiateCryptoSessionKeyExchangeMTStart	Logging	N
1823	ID3D11VideoDevice_NegotiateCryptoSessionKeyExchangeMTStop	Logging	N
1824	ID3D11TrackedWorkload_Processed	Logging	N
1825	ID3D11TrackedWorkload_Completed	Logging	N
1826	CheckPresentDurationSupport	Logging	N

Event ID 1: Name

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Name

Fields #

Name	Description
`pObject` Pointer
`CchOldDebugObjectName` UInt32
`OldDebugObjectName` AnsiString
`CchNewDebugObjectName` UInt32
`NewDebugObjectName` AnsiString

Event ID 2: NameDCStart

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Name
Opcode: DC_Start

Fields #

Name	Description
`pObject` Pointer
`CchDebugObjectName` UInt32
`DebugObjectName` AnsiString

Event ID 3: DeviceStart

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Device
Opcode: Start

Fields #

Name	Description
`pID3D11Device` Pointer
`pIDXGIDevice` Pointer
`pIDXGIAdapter` Pointer
`CreationFlags` UInt32
`FeatureLevel` UInt32
`FeatureSupport` UInt32
`hKMAdapter` UInt32
`hUMAdapter` Pointer
`UMAdapterVersion` UInt64
`hKMDevice` UInt32
`hUMDevice` Pointer
`UMDeviceVersion` UInt64
`UMDeviceFlags` UInt32

Event ID 4: DeviceStop

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Device
Opcode: Stop

Fields #

Name	Description
`pID3D11Device` Pointer
`pIDXGIDevice` Pointer
`pIDXGIAdapter` Pointer
`CreationFlags` UInt32
`FeatureLevel` UInt32
`FeatureSupport` UInt32
`hKMAdapter` UInt32
`hUMAdapter` Pointer
`UMAdapterVersion` UInt64
`hKMDevice` UInt32
`hUMDevice` Pointer
`UMDeviceVersion` UInt64
`UMDeviceFlags` UInt32

Event ID 5: DeviceDCStart

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Device
Opcode: DC_Start

Fields #

Name	Description
`pID3D11Device` Pointer
`pIDXGIDevice` Pointer
`pIDXGIAdapter` Pointer
`CreationFlags` UInt32
`FeatureLevel` UInt32
`FeatureSupport` UInt32
`hKMAdapter` UInt32
`hUMAdapter` Pointer
`UMAdapterVersion` UInt64
`hKMDevice` UInt32
`hUMDevice` Pointer
`UMDeviceVersion` UInt64
`UMDeviceFlags` UInt32

Event ID 6: BufferStart

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Buffer
Opcode: Start

Fields #

Name	Description
`pID3D11Resource` Pointer
`pIDXGISurface` Pointer
`pID3D11Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`StructureByteStride` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 7: BufferStop

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Buffer
Opcode: Stop

Fields #

Name	Description
`pID3D11Resource` Pointer
`pIDXGISurface` Pointer
`pID3D11Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`StructureByteStride` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 8: BufferDCStart

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Buffer
Opcode: DC_Start

Fields #

Name	Description
`pID3D11Resource` Pointer
`pIDXGISurface` Pointer
`pID3D11Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`StructureByteStride` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 9: Texture1DStart

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Texture1D
Opcode: Start

Fields #

Name	Description
`pID3D11Resource` Pointer
`pIDXGISurface` Pointer
`pID3D11Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`StructureByteStride` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 10: Texture1DStop

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Texture1D
Opcode: Stop

Fields #

Name	Description
`pID3D11Resource` Pointer
`pIDXGISurface` Pointer
`pID3D11Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`StructureByteStride` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 11: Texture1DDCStart

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Texture1D
Opcode: DC_Start

Fields #

Name	Description
`pID3D11Resource` Pointer
`pIDXGISurface` Pointer
`pID3D11Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`StructureByteStride` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 12: CreateTexture2D

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Texture2D
Opcode: Start

Description

CreateTexture2D.

Message #

CreateTexture2D

Fields #

Name	Description
`pID3D11Resource` Pointer
`pIDXGISurface` Pointer
`pID3D11Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`StructureByteStride` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 13: DestroyTexture2D

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Texture2D
Opcode: Stop

Description

DestroyTexture2D.

Message #

DestroyTexture2D

Fields #

Name	Description
`pID3D11Resource` Pointer
`pIDXGISurface` Pointer
`pID3D11Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`StructureByteStride` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 14: ReportTexture2D

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Texture2D
Opcode: DC_Start

Description

ReportTexture2D.

Message #

ReportTexture2D

Fields #

Name	Description
`pID3D11Resource` Pointer
`pIDXGISurface` Pointer
`pID3D11Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`StructureByteStride` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 15: Texture3DStart

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Texture3D
Opcode: Start

Fields #

Name	Description
`pID3D11Resource` Pointer
`pIDXGISurface` Pointer
`pID3D11Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`StructureByteStride` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 16: Texture3DStop

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Texture3D
Opcode: Stop

Fields #

Name	Description
`pID3D11Resource` Pointer
`pIDXGISurface` Pointer
`pID3D11Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`StructureByteStride` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 17: Texture3DDCStart

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Texture3D
Opcode: DC_Start

Fields #

Name	Description
`pID3D11Resource` Pointer
`pIDXGISurface` Pointer
`pID3D11Device` Pointer
`Dimension` UInt32
`Usage` UInt32
`Width` UInt32
`Height` UInt32
`Depth` UInt32
`MipLevels` UInt32
`ArraySize` UInt32
`Format` UInt32
`SampleCount` UInt32
`SampleQuality` UInt32
`BindFlags` UInt32
`CPUAccessFlags` UInt32
`MiscFlags` UInt32
`StructureByteStride` UInt32
`hKMResource` UInt32
`hUMResource` Pointer
`UMResourceMiscFlags` UInt32

Event ID 18: RotateTexture2DIdentities

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Also via: realtime ETW trace
Task: Texture2D
Opcode: win:Info

Description

RotateTexture2DIdentities.

Message #

RotateTexture2DIdentities

Fields #

Name	Description
`Resources` UInt32
`pIDXGISurfaces` Pointer
`hNewKMResources` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Direct3D11",
    "guid": "{DB6F6DDB-AC77-4E88-8253-819DF9BBF140}",
    "event_source_name": "",
    "event_id": 18,
    "version": 0,
    "level": 0,
    "task": 6,
    "opcode": 0,
    "keywords": "0x0000000000000004",
    "time_created": "2026-06-02T05:15:50.630+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Resources": 2,
    "hNewKMResources": 2201561208,
    "pIDXGISurfaces": "0x1B783392B18"
  },
  "message": "Texture2D"
}

Event ID 19: Device

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Device

Fields #

Name	Description
`SemaphoreHandle` Pointer
`AdjustValue` UInt32
`PresentCount` UInt32

Event ID 20: D3D11CoreCreateDeviceStart

Provider: Microsoft-Windows-Direct3D11
Channel: PerfTiming
Task: D3D11CoreCreateDevice
Opcode: Start

Event ID 21: D3D11CoreCreateDeviceStop

Provider: Microsoft-Windows-Direct3D11
Channel: PerfTiming
Task: D3D11CoreCreateDevice
Opcode: Stop

Event ID 22: KMDDeviceCreateStart

Provider: Microsoft-Windows-Direct3D11
Channel: PerfTiming
Task: KMDDeviceCreate
Opcode: Start

Event ID 23: KMDDeviceCreateStop

Provider: Microsoft-Windows-Direct3D11
Channel: PerfTiming
Task: KMDDeviceCreate
Opcode: Stop

Event ID 24: UMDDeviceCreateStart

Provider: Microsoft-Windows-Direct3D11
Channel: PerfTiming
Task: UMDDeviceCreate
Opcode: Start

Event ID 25: UMDDeviceCreateStop

Provider: Microsoft-Windows-Direct3D11
Channel: PerfTiming
Task: UMDDeviceCreate
Opcode: Stop

Event ID 26: D3DSupplemental

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: D3DSupplemental

Fields #

Name	Description
`BufferSize` UInt32
`Buffer` Binary

Event ID 27: QueryInterface

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: QueryInterface

Fields #

Name	Description
`pThis` Pointer
`riid` GUID
`m_Ret` UInt32
`ppvObject` Pointer

Event ID 28: AddRef

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: AddRef

Fields #

Name	Description
`pThis` Pointer
`ReturnValue` UInt32

Event ID 29: Release

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: Release

Fields #

Name	Description
`pThis` Pointer
`ReturnValue` UInt32

Event ID 30: Destruction

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: Destruction

Fields #

Name	Description
`pThis` Pointer

Event ID 31: UMD10CreateDeviceStart

Provider: Microsoft-Windows-Direct3D11
Channel: PerfTiming
Task: UMD10CreateDevice
Opcode: Start

Event ID 32: UMD10CreateDeviceStop

Provider: Microsoft-Windows-Direct3D11
Channel: PerfTiming
Task: UMD10CreateDevice
Opcode: Stop

Event ID 33: UMDOpenAdapterStart

Provider: Microsoft-Windows-Direct3D11
Channel: PerfTiming
Task: UMDOpenAdapter
Opcode: Start

Event ID 34: UMDOpenAdapterStop

Provider: Microsoft-Windows-Direct3D11
Channel: PerfTiming
Task: UMDOpenAdapter
Opcode: Stop

Event ID 35: ContextStart

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Context
Opcode: Start

Fields #

Name	Description
`pID3D11Device` Pointer
`pID3D11DeviceContext` Pointer
`ContextType` UInt32
`ContextFlags` UInt32

Event ID 36: ContextStop

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Context
Opcode: Stop

Fields #

Name	Description
`pID3D11Device` Pointer
`pID3D11DeviceContext` Pointer
`ContextType` UInt32
`ContextFlags` UInt32

Event ID 37: ContextDCStart

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Context
Opcode: DC_Start

Fields #

Name	Description
`pID3D11Device` Pointer
`pID3D11DeviceContext` Pointer
`ContextType` UInt32
`ContextFlags` UInt32

Event ID 38: Marker

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: Marker

Fields #

Name	Description
`pID3D11DeviceContext` Pointer
`APISequenceNumber` UInt64
`Label` UnicodeString
`Data` Int32

Event ID 39: RuntimeMarker

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: RuntimeMarker

Fields #

Name	Description
`CPUFrequency` UInt64
`FirstAPISequenceNumber` UInt64
`pID3D11DeviceContext` Pointer
`CPUTimeHigh` UInt32
`ThreadIDs` UInt8
`ThreadID` UInt32
`DataSize` UInt32
`Data` UInt8

Event ID 40: RuntimeDroppedCall

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: RuntimeDroppedCall

Fields #

Name	Description
`pID3D11DeviceContext` Pointer
`Type` UInt32

Event ID 41: RuntimeMarker41

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: RuntimeMarker

Fields #

Name	Description
`pIDXGIDevice` Pointer
`hContext` UInt32
`BroadcastContexts` UInt8
`hBroadcastContexts` UInt32
`MarkerLogType` UInt32
`RenderCBSequenceNumber` UInt32
`FirstAPISequenceNumberHigh` UInt32
`CompletedAPISequenceNumberLow0Size` UInt32
`CompletedAPISequenceNumberLow1Size` UInt32
`BegunAPISequenceNumberLow0Size` UInt32
`BegunAPISequenceNumberLow1Size` UInt32
`CompletedAPISequenceNumberLow0` UInt32
`CompletedAPISequenceNumberLow1` UInt32
`BegunAPISequenceNumberLow0` UInt32
`BegunAPISequenceNumberLow1` UInt32

Event ID 42: CommandListStart

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: CommandList
Opcode: Start

Fields #

Name	Description
`pID3D11DeviceContext` Pointer
`pID3D11CommandList` Pointer

Event ID 43: CommandListStop

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: CommandList
Opcode: Stop

Fields #

Name	Description
`pID3D11DeviceContext` Pointer
`pID3D11CommandList` Pointer

Event ID 44: CommandListDCStart

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: CommandList
Opcode: DC_Start

Fields #

Name	Description
`pID3D11DeviceContext` Pointer
`pID3D11CommandList` Pointer

Event ID 45: CustomDriverMarker

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: CustomDriverMarker

Fields #

Name	Description
`InsertionAPISequenceNumber` UInt64
`pID3D11DeviceContext` Pointer
`hContext` UInt32
`Index` Int32
`StringIndex` Int32
`MarkerDescription` UnicodeString

Event ID 46: CustomDriverMarker46

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: CustomDriverMarker

Fields #

Name	Description
`pID3D11Device` Pointer
`StringIndex` Int32
`Description` UnicodeString

Event ID 1714: IDXGIDevice2_OfferResourcesStart

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: IDXGIDevice2_OfferResources
Opcode: Start

Fields #

Name	Description
`pThis` Pointer
`NumResources` UInt32
`ppResources` Pointer
`Priority` UInt32

Event ID 1715: IDXGIDevice2_OfferResourcesStop

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: IDXGIDevice2_OfferResources
Opcode: Stop

Fields #

Name	Description
`m_Ret` UInt32

Event ID 1716: IDXGIDevice2_ReclaimResourcesStart

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: IDXGIDevice2_ReclaimResources
Opcode: Start

Fields #

Name	Description
`pThis` Pointer
`NumResources` UInt32
`ppResources` Pointer
`NumDiscardedResources` UInt32
`pDiscarded` UInt32

Event ID 1717: IDXGIDevice2_ReclaimResourcesStop

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: IDXGIDevice2_ReclaimResources
Opcode: Stop

Fields #

Name	Description
`m_Ret` UInt32
`pDiscarded` UInt32

Event ID 1720: ID3D11VideoDevice_CreateVideoProcessorStart

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoDevice_CreateVideoProcessor
Opcode: Start

Fields #

Name	Description
`pThis` Pointer
`pEnum` Pointer
`RateConversionIndex` UInt32
`ppVideoProcessor` Pointer

Event ID 1721: ID3D11VideoDevice_CreateVideoProcessorStop

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoDevice_CreateVideoProcessor
Opcode: Stop

Fields #

Name	Description
`m_Ret` UInt32
`ppVideoProcessor` Pointer

Event ID 1722: ID3D11VideoDevice_CreateVideoDecoderStart

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoDevice_CreateVideoDecoder
Opcode: Start

Fields #

Name	Description
`pThis` Pointer
`pVideoDescTID_D3D11_VIDEO_DECODER_DESC` UInt8
`pConfigTID_D3D11_VIDEO_DECODER_CONFIG` UInt32
`ppDecoder` Pointer

Event ID 1723: ID3D11VideoDevice_CreateVideoDecoderStop

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoDevice_CreateVideoDecoder
Opcode: Stop

Fields #

Name	Description
`m_Ret` UInt32
`ppDecoder` Pointer

Event ID 1728: ID3D11VideoProcessor_ReleaseStart

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoProcessor_Release
Opcode: Start

Fields #

Name	Description
`pThis` Pointer

Event ID 1729: ID3D11VideoProcessor_ReleaseStop

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoProcessor_Release
Opcode: Stop

Fields #

Name	Description
`m_Ret` UInt32

Event ID 1734: ID3D11VideoDecoder_ReleaseStart

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoDecoder_Release
Opcode: Start

Fields #

Name	Description
`pThis` Pointer

Event ID 1735: ID3D11VideoDecoder_ReleaseStop

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoDecoder_Release
Opcode: Stop

Fields #

Name	Description
`m_Ret` UInt32

Event ID 1778: ID3D11VideoContext_VideoProcessorBltStart

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoContext_VideoProcessorBlt
Opcode: Start

Fields #

Name	Description
`pThis` Pointer
`pVideoProcessor` Pointer
`pView` Pointer
`OutputFrame` UInt32
`StreamCount` UInt32
`pStreamsTID_D3D11_VIDEO_PROCESSOR_STREAM` UInt16

Event ID 1779: ID3D11VideoContext_VideoProcessorBltStop

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoContext_VideoProcessorBlt
Opcode: Stop

Fields #

Name	Description
`m_Ret` UInt32

Event ID 1780: ID3D11VideoContext_GetDecoderBufferStart

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoContext_GetDecoderBuffer
Opcode: Start

Fields #

Name	Description
`pThis` Pointer
`pDecoder` Pointer
`Type` UInt32
`pBufferSize` UInt32
`ppBuffer` Pointer

Event ID 1781: ID3D11VideoContext_GetDecoderBufferStop

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoContext_GetDecoderBuffer
Opcode: Stop

Fields #

Name	Description
`m_Ret` UInt32
`pBufferSize` UInt32
`ppBuffer` Pointer

Event ID 1784: ID3D11VideoContext_DecoderBeginFrameStart

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoContext_DecoderBeginFrame
Opcode: Start

Fields #

Name	Description
`pThis` Pointer
`pDecoder` Pointer
`View` Pointer
`ContentKeySize` UInt32
`pContentKey` Pointer

Event ID 1785: ID3D11VideoContext_DecoderBeginFrameStop

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoContext_DecoderBeginFrame
Opcode: Stop

Fields #

Name	Description
`m_Ret` UInt32

Event ID 1786: ID3D11VideoContext_DecoderEndFrameStart

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoContext_DecoderEndFrame
Opcode: Start

Fields #

Name	Description
`pThis` Pointer
`pDecoder` Pointer

Event ID 1787: ID3D11VideoContext_DecoderEndFrameStop

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoContext_DecoderEndFrame
Opcode: Stop

Fields #

Name	Description
`m_Ret` UInt32

Event ID 1788: ID3D11VideoContext_SubmitDecoderBuffersStart

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoContext_SubmitDecoderBuffers
Opcode: Start

Fields #

Name	Description
`pThis` Pointer
`pDecoder` Pointer
`NumBuffers` UInt32
`pBufferDescTID_D3D11_VIDEO_DECODER_BUFFER_DESC` UInt8

Event ID 1789: ID3D11VideoContext_SubmitDecoderBuffersStop

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoContext_SubmitDecoderBuffers
Opcode: Stop

Fields #

Name	Description
`m_Ret` UInt32

Event ID 1804: IDXGIDevice3_TrimStart

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: IDXGIDevice3_Trim
Opcode: Start

Fields #

Name	Description
`pDXGIDevice` Pointer

Event ID 1805: IDXGIDevice3_TrimStop

Provider: Microsoft-Windows-Direct3D11
Channel: Analytic
Task: IDXGIDevice3_Trim
Opcode: Stop

Event ID 1806: ID3D11VideoDevice_CreateCryptoSessionStart

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoDevice_CreateCryptoSession
Opcode: Start

Fields #

Name	Description
`pThis` Pointer
`CryptoType` GUID
`KeyExhangeType` GUID
`ppCryptoSession` Pointer

Event ID 1807: ID3D11VideoDevice_CreateCryptoSessionStop

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoDevice_CreateCryptoSession
Opcode: Stop

Fields #

Name	Description
`m_Ret` UInt32
`ppCryptoSession` Pointer

Event ID 1808: ID3D11VideoContext_NegotiateCryptoSessionKeyExchangeStart

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoContext_NegotiateCryptoSessionKeyExchange
Opcode: Start

Fields #

Name	Description
`pThis` Pointer
`pCryptoSession` Pointer

Event ID 1809: ID3D11VideoContext_NegotiateCryptoSessionKeyExchangeStop

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoContext_NegotiateCryptoSessionKeyExchange
Opcode: Stop

Fields #

Name	Description
`m_Ret` UInt32

Event ID 1810: ID3D11VideoContext_VideoProcessorGetBehaviorHintsStart

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoContext_VideoProcessorGetBehaviorHints
Opcode: Start

Fields #

Name	Description
`pThis` Pointer
`pVideoProcessor` Pointer
`OutputWidth` UInt32
`OutputHeight` UInt32
`OutputFormat` UInt32
`StreamCount` UInt32

Event ID 1811: ID3D11VideoContext_VideoProcessorGetBehaviorHintsStop

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoContext_VideoProcessorGetBehaviorHints
Opcode: Stop

Fields #

Name	Description
`BehaviorHints` UInt32
`m_Ret` UInt32

Event ID 1812: CryptoSessionTeardownCount

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: CryptoSessionTeardownCount

Fields #

Name	Description
`pThis` Pointer
`pCryptoSession` Pointer
`TeardownCount` UInt32

Event ID 1813: RecoverTeardown

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: RecoverTeardown

Fields #

Name	Description
`pThis` Pointer
`TeardownCount` UInt32
`Recover` UInt32

Event ID 1814: ID3D11VideoContext_VideoProcessorBltParameters

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoContext_VideoProcessorBltParameters

Fields #

Name	Description
`pThis` Pointer
`SourceWidth` UInt32
`SourceHeight` UInt32
`SourceFormat` UInt32
`SourceColorspace` UInt32
`DestWidth` UInt32
`DestHeight` UInt32
`DestFormat` UInt32
`DestColorspace` UInt32
`Rotation` UInt32

Event ID 1815: ID3D11VideoDevice_DestroyCryptoSessionStart

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoDevice_DestroyCryptoSession
Opcode: Start

Fields #

Name	Description
`pCryptoSession` Pointer

Event ID 1816: ID3D11VideoDevice_DestroyCryptoSessionStop

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoDevice_DestroyCryptoSession
Opcode: Stop

Fields #

Name	Description
`pCryptoSession` Pointer

Event ID 1817: ID3D11VideoContext_GetDataForNewHardwareKey

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoContext_GetDataForNewHardwareKey

Fields #

Name	Description
`pThis` Pointer
`TeardownCount` UInt32
`Result` UInt32

Event ID 1818: ID3D11VideoContext_SubmitDecoderBuffers1Start

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoContext_SubmitDecoderBuffers1
Opcode: Start

Fields #

Name	Description
`pThis` Pointer
`pDecoder` Pointer
`NumBuffers` UInt32
`pBufferDescTID_D3D11_VIDEO_DECODER_BUFFER_DESC1` UInt8

Event ID 1819: ID3D11VideoContext_SubmitDecoderBuffers1Stop

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoContext_SubmitDecoderBuffers1
Opcode: Stop

Fields #

Name	Description
`m_Ret` UInt32

Event ID 1820: JournalEntry

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: JournalEntry

Fields #

Name	Description
`Index` UInt32
`Code` HexInt32
`ThreadId` UInt32
`Message` AnsiString

Event ID 1821: IDXGIResource_CreateSharedHandle

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: IDXGIResource_CreateSharedHandle

Fields #

Name	Description
`hKMResource` UInt32
`hUMSharedResource` Pointer
`Name` UnicodeString

Event ID 1822: ID3D11VideoDevice_NegotiateCryptoSessionKeyExchangeMTStart

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoDevice_NegotiateCryptoSessionKeyExchangeMT
Opcode: Start

Fields #

Name	Description
`pThis` Pointer
`pCryptoSession` Pointer

Event ID 1823: ID3D11VideoDevice_NegotiateCryptoSessionKeyExchangeMTStop

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11VideoDevice_NegotiateCryptoSessionKeyExchangeMT
Opcode: Stop

Fields #

Name	Description
`m_Ret` UInt32

Event ID 1824: ID3D11TrackedWorkload_Processed

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11TrackedWorkload_Processed

Fields #

Name	Description
`pThis` Pointer
`beginIndex` UInt32
`endIndex` UInt32
`gpuDuration` UInt32

Event ID 1825: ID3D11TrackedWorkload_Completed

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: ID3D11TrackedWorkload_Completed

Fields #

Name	Description
`pThis` Pointer
`Index` UInt32
`Timestamp` UInt64

Event ID 1826: CheckPresentDurationSupport

Provider: Microsoft-Windows-Direct3D11
Channel: Logging
Task: CheckPresentDurationSupport

Fields #

Name	Description
`DesiredPresentDuration` UInt32
`ClosestSmallerDuration` UInt32
`ClosestLargerDuration` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {DB6F6DDB-AC77-4E88-8253-819DF9BBF140}

Defined in d3d11.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.3451, captured 2026-06-02
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3451, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)