Microsoft-Windows-DUSER

72 events across 1 channel

Event	Title	Channel	Sample
1	DUser_PaintStart	Diagnostic	N
2	DUser_PaintStop	Diagnostic	N
3	DUser_SyncAdaptorsStart	Diagnostic	N
4	DUser_SyncAdaptorsStop	Diagnostic	N
5	DUser_ResetInvalidStart	Diagnostic	N
6	DUser_ResetInvalidStop	Diagnostic	N
7	DUser_EndDrawBitBltStart	Diagnostic	N
8	DUser_EndDrawBitBltStop	Diagnostic	N
9	DUser_InputStart	Diagnostic	N
10	DUser_InputStop	Diagnostic	N
11	DUser_InputStart11	Diagnostic	N
12	DUser_LayeredCreateVisualsStart	Diagnostic	N
13	DUser_LayeredRemoveVisualsStart	Diagnostic	N
14	DUser_LayeredDestructVisualsStart	Diagnostic	N
15	DUser_DestroyPendingDCVisualsStart	Diagnostic	N
16	DUser_DestroyPendingDCVisualsStop	Diagnostic	N
17	DUser_ForceDestroyDCVisualStart	Diagnostic	N
18	DUser_RemoveAndDestroyDCVisualStart	Diagnostic	N
19	DUser_DrawLayeredGadgetStart	Diagnostic	N
20	DUser_DrawLayeredGadgetStart20	Diagnostic	N
21	DUser_LayeredGetBitmapStart	Diagnostic	N
22	DUser_LayeredSetContentStart	Diagnostic	N
24	DUser_LayerGadgetStart	Diagnostic	N
25	DUser_LayerGadgetStop	Diagnostic	N
26	DUser_LayerGadgetLoopStart	Diagnostic	N
27	DUser_LayerGadgetLoopStop	Diagnostic	N
28	DUser_CreateCompatibleBitmapStart	Diagnostic	N
29	DUser_CreateCompatibleBitmapStop	Diagnostic	N
30	DUser_InitPropertiesStart	Diagnostic	N
31	DUser_InitPropertiesStop	Diagnostic	N
32	DUser_AddChildVisualStart	Diagnostic	N
33	DUser_AddChildVisualStop	Diagnostic	N
34	DUser_MoveChildrenToParent	Diagnostic	N
35	DUser_MoveChildrenToParentStart	Diagnostic	N
36	DUser_MoveChildrenToParentStop	Diagnostic	N
37	DUser_Reparent	Diagnostic	N
38	DUser_ReparentStart	Diagnostic	N
39	DUser_ReparentStop	Diagnostic	N
40	DUser_AddWAMTransitionsStart	Diagnostic	N
41	DUser_AddWAMTransitionsStop	Diagnostic	N
42	DUser_CreateCubicBezierLinearVectorTransition	Diagnostic	N
43	DUser_ScheduleWAMStoryboardStart	Diagnostic	N
44	DUser_ScheduleWAMStoryboardStop	Diagnostic	N
45	DUser_GetCurve	Diagnostic	N
46	DUser_DCompCommitStart	Diagnostic	N
47	DUser_DCompCommitStop	Diagnostic	N
48	DUser_DCompCommit	Diagnostic	N
49	DUser_DrawDirtyLayers	Diagnostic	N
50	DUser_CommitFromWMPaint	Diagnostic	N
51	DUser_ScheduleTransitionsStart	Diagnostic	N
52	DUser_ScheduleTransitionsStop	Diagnostic	N
53	DUser_WAMDelayStart	Diagnostic	N
54	DUser_WAMDelayStop	Diagnostic	N
55	DUser_Input	Diagnostic	N
56	DUser_TransitionComplete	Diagnostic	N
65	DUser_IntervalAcquireRegionStart	Diagnostic	N
66	DUser_IntervalAcquireRegionStop	Diagnostic	N
67	DUser_IntervalReleaseRegionStart	Diagnostic	N
68	DUser_IntervalReleaseRegionStop	Diagnostic	N
71	DUser_CreateSurface	Diagnostic	N
72	DUser_DestroySurface	Diagnostic	N
75	DUser_ProcessPendingStoryboards	Diagnostic	N
76	DUser_TransitionScheduled	Diagnostic	N
77	DUser_InitializeDCompTransforms	Diagnostic	N
78	DUser_ModifyDCompTransform	Diagnostic	N
79	DUser_RunDUIPVLAnimationStart	Diagnostic	N
80	DUser_RunDUIPVLAnimationStop	Diagnostic	N
81	DUser_AllocateStagingBuffer	Diagnostic	N
82	DUser_ReleaseStagingBuffer	Diagnostic	N
83	DUser_LeafNodeOpacity_PossibleLayerPush	Diagnostic	N
84	DUser_StagingBufferCopy	Diagnostic	N
85	DUser_Input85	Diagnostic	N

Event ID 1: DUser_PaintStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Paint
Opcode: Start

Event ID 2: DUser_PaintStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Paint
Opcode: Stop

Event ID 3: DUser_SyncAdaptorsStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_SyncAdaptors
Opcode: Start

Event ID 4: DUser_SyncAdaptorsStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_SyncAdaptors
Opcode: Stop

Fields #

Name	Description
`cAdaptors` Int32

Event ID 5: DUser_ResetInvalidStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ResetInvalid
Opcode: Start

Event ID 6: DUser_ResetInvalidStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ResetInvalid
Opcode: Stop

Event ID 7: DUser_EndDrawBitBltStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_EndDrawBitBlt
Opcode: Start

Event ID 8: DUser_EndDrawBitBltStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_EndDrawBitBlt
Opcode: Stop

Event ID 9: DUser_InputStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Input
Opcode: Start

Event ID 10: DUser_InputStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Input
Opcode: Stop

Event ID 11: DUser_InputStart11

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Input
Opcode: Start

Event ID 12: DUser_LayeredCreateVisualsStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LayeredCreateVisuals
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`fRoot` Boolean

Event ID 13: DUser_LayeredRemoveVisualsStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LayeredRemoveVisuals
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`fRoot` Boolean
`nWidth` Int32
`nHeight` Int32
`fIsCopy` Boolean

Event ID 14: DUser_LayeredDestructVisualsStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LayeredDestructVisuals
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`fRoot` Boolean

Event ID 15: DUser_DestroyPendingDCVisualsStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_DestroyPendingDCVisuals
Opcode: Start

Fields #

Name	Description
`nNumberOfPendingDeletions` Int32

Event ID 16: DUser_DestroyPendingDCVisualsStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_DestroyPendingDCVisuals
Opcode: Stop

Fields #

Name	Description
`nNumberOfPendingDeletions` Int32

Event ID 17: DUser_ForceDestroyDCVisualStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ForceDestroyDCVisual
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`fRoot` Boolean

Event ID 18: DUser_RemoveAndDestroyDCVisualStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_RemoveAndDestroyDCVisual
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`fRoot` Boolean

Event ID 19: DUser_DrawLayeredGadgetStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_DrawLayeredGadget
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`fRoot` Boolean
`nWidth` Int32
`nHeight` Int32
`fIsCopy` Boolean

Event ID 20: DUser_DrawLayeredGadgetStart20

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_DrawLayeredGadget
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`fRoot` Boolean
`nWidth` Int32
`nHeight` Int32
`fIsCopy` Boolean

Event ID 21: DUser_LayeredGetBitmapStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LayeredGetBitmap
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`fRoot` Boolean
`nWidth` Int32
`nHeight` Int32
`fIsCopy` Boolean

Event ID 22: DUser_LayeredSetContentStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LayeredSetContent
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`fRoot` Boolean
`nWidth` Int32
`nHeight` Int32
`fIsCopy` Boolean

Event ID 24: DUser_LayerGadgetStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LayerGadget
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32

Event ID 25: DUser_LayerGadgetStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LayerGadget
Opcode: Stop

Fields #

Name	Description
`hGadget` UInt32
`fNewLayered` Boolean
`nVisualsCount` Int32

Event ID 26: DUser_LayerGadgetLoopStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LayerGadgetLoop
Opcode: Start

Fields #

Name	Description
`cTrans` UInt32
`dwTicket` UInt32

Event ID 27: DUser_LayerGadgetLoopStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LayerGadgetLoop
Opcode: Stop

Fields #

Name	Description
`cTrans` UInt32
`dwTicket` UInt32

Event ID 28: DUser_CreateCompatibleBitmapStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_CreateCompatibleBitmap
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`nWidth` Int32
`nHeight` Int32

Event ID 29: DUser_CreateCompatibleBitmapStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_CreateCompatibleBitmap
Opcode: Stop

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`nWidth` Int32
`nHeight` Int32

Event ID 30: DUser_InitPropertiesStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_InitProperties
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`pDCompVisual` Pointer

Event ID 31: DUser_InitPropertiesStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_InitProperties
Opcode: Stop

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`pDCompVisual` Pointer

Event ID 32: DUser_AddChildVisualStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_AddChildVisual
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`pDCompVisual` Pointer

Event ID 33: DUser_AddChildVisualStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_AddChildVisual
Opcode: Stop

Fields #

Name	Description
`hGadget` UInt32
`pChildVisual` Pointer
`fDescendantVisualOfNewVisual` Boolean
`pDCompVisual` Pointer

Event ID 34: DUser_MoveChildrenToParent

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_MoveChildrenToParent

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`m_pParent` Pointer

Event ID 35: DUser_MoveChildrenToParentStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_MoveChildrenToParent
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`pDCompVisual` Pointer

Event ID 36: DUser_MoveChildrenToParentStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_MoveChildrenToParent
Opcode: Stop

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`pDCompVisual` Pointer

Event ID 37: DUser_Reparent

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Reparent

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`pDCompVisual` Pointer

Event ID 38: DUser_ReparentStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Reparent
Opcode: Start

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`pNewChild` Pointer

Event ID 39: DUser_ReparentStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Reparent
Opcode: Stop

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`pNewChild` Pointer

Event ID 40: DUser_AddWAMTransitionsStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_AddWAMTransitions
Opcode: Start

Fields #

Name	Description
`cTrans` UInt32
`dwTicket` UInt32

Event ID 41: DUser_AddWAMTransitionsStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_AddWAMTransitions
Opcode: Stop

Fields #

Name	Description
`cTrans` UInt32
`dwTicket` UInt32

Event ID 42: DUser_CreateCubicBezierLinearVectorTransition

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_CreateCubicBezierLinearVectorTransition

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`nAnimType` Int32

Event ID 43: DUser_ScheduleWAMStoryboardStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ScheduleWAMStoryboard
Opcode: Start

Fields #

Name	Description
`cTrans` UInt32
`psbUIA` Pointer
`dwTicket` UInt32

Event ID 44: DUser_ScheduleWAMStoryboardStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ScheduleWAMStoryboard
Opcode: Stop

Fields #

Name	Description
`cTrans` UInt32
`psbUIA` Pointer
`dwTicket` UInt32

Event ID 45: DUser_GetCurve

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_GetCurve

Fields #

Name	Description
`hGadget` UInt32
`pVisual` Pointer
`nVar` Int32

Event ID 46: DUser_DCompCommitStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_DCompCommit
Opcode: Start

Fields #

Name	Description
`nSize` Int32

Event ID 47: DUser_DCompCommitStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_DCompCommit
Opcode: Stop

Fields #

Name	Description
`nSize` Int32

Event ID 48: DUser_DCompCommit

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_DCompCommit

Fields #

Name	Description
`nSize` Int32

Event ID 49: DUser_DrawDirtyLayers

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_DrawDirtyLayers

Fields #

Name	Description
`hGadget` UInt32
`m_pVisual` Pointer
`nVisuals` Int32

Event ID 50: DUser_CommitFromWMPaint

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_CommitFromWMPaint

Fields #

Name	Description
`hGadget` UInt32
`m_pVisual` Pointer
`nVisuals` Int32

Event ID 51: DUser_ScheduleTransitionsStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ScheduleTransitions
Opcode: Start

Fields #

Name	Description
`dwTicket` UInt32

Event ID 52: DUser_ScheduleTransitionsStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ScheduleTransitions
Opcode: Stop

Fields #

Name	Description
`dwTicket` UInt32

Event ID 53: DUser_WAMDelayStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_WAMDelay
Opcode: Start

Fields #

Name	Description
`cTrans` UInt32
`psbUIA` Pointer
`dwTicket` UInt32

Event ID 54: DUser_WAMDelayStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_WAMDelay
Opcode: Stop

Fields #

Name	Description
`nVisuals` Int32

Event ID 55: DUser_Input

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Input

Fields #

Name	Description
`PointerID` UInt32

Event ID 56: DUser_TransitionComplete

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_TransitionComplete

Fields #

Name	Description
`hGadget` UInt32
`nCode` UInt32
`fCopy` Boolean
`fRemainLayered` Boolean

Event ID 65: DUser_IntervalAcquireRegionStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_IntervalAcquireRegion
Opcode: Start

Event ID 66: DUser_IntervalAcquireRegionStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_IntervalAcquireRegion
Opcode: Stop

Event ID 67: DUser_IntervalReleaseRegionStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_IntervalReleaseRegion
Opcode: Start

Event ID 68: DUser_IntervalReleaseRegionStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_IntervalReleaseRegion
Opcode: Stop

Event ID 71: DUser_CreateSurface

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_CreateSurface

Fields #

Name	Description
`surfaceId` Pointer
`surfaceX` Int32
`surfaceY` Int32
`surfaceWidth` Int32
`surfaceHeight` Int32
`containerId` Pointer
`containerWidth` Int32
`containerHeight` Int32
`pRegionSurface` Pointer
`pSurface` Pointer

Event ID 72: DUser_DestroySurface

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_DestroySurface

Fields #

Name	Description
`pRegionSurface` Pointer
`pSurface` Pointer

Event ID 75: DUser_ProcessPendingStoryboards

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ProcessPendingStoryboards

Fields #

Name	Description
`flProcessingDelay` Float
`nNumberOfStoryboards` Int32
`nNumberOfVisuals` Int32

Event ID 76: DUser_TransitionScheduled

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_TransitionScheduled

Fields #

Name	Description
`cTrans` UInt32
`uTransIndex` UInt32
`dwTicket` UInt32
`hGadget` UInt32
`nProperty` UInt32
`pTransitionVisual` Pointer
`pDCompVisual` Pointer

Event ID 77: DUser_InitializeDCompTransforms

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_InitializeDCompTransforms

Fields #

Name	Description
`nHResult` Int32
`hGadget` UInt32
`fIsCopy` Boolean
`pTransitionVisual` Pointer
`pDCompVisual` Pointer
`pEffectGroup` Pointer

Event ID 78: DUser_ModifyDCompTransform

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ModifyDCompTransform

Fields #

Name	Description
`pTransitionVisual` Pointer
`pDCompVisual` Pointer
`nTransformType` Int32
`pTransform` Pointer
`fAnimation` Boolean

Event ID 79: DUser_RunDUIPVLAnimationStart

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_RunDUIPVLAnimation
Opcode: Start

Fields #

Name	Description
`pStoryboard` Pointer
`nAnimationId` Int32
`nStoryboardId` Int32
`nCode` Int32
`flProcessingDelay` Float

Event ID 80: DUser_RunDUIPVLAnimationStop

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_RunDUIPVLAnimation
Opcode: Stop

Fields #

Name	Description
`pStoryboard` Pointer
`nAnimationId` Int32
`nStoryboardId` Int32
`nCode` Int32
`flProcessingDelay` Float

Event ID 81: DUser_AllocateStagingBuffer

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_AllocateStagingBuffer

Fields #

Name	Description
`surfaceId` Pointer
`surfaceX` Int32
`surfaceY` Int32

Event ID 82: DUser_ReleaseStagingBuffer

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_ReleaseStagingBuffer

Fields #

Name	Description
`surfaceId` Pointer

Event ID 83: DUser_LeafNodeOpacity_PossibleLayerPush

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_LeafNodeOpacity_PossibleLayerPush

Fields #

Name	Description
`hGadget` Pointer
`nWidth` Int32
`nHeight` Int32
`hAncestorGadget` Pointer
`nAncestorWidth` Int32
`nAncestorHeight` Int32

Event ID 84: DUser_StagingBufferCopy

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_StagingBufferCopy

Fields #

Name	Description
`surfaceId` Pointer
`surfaceX` Int32
`surfaceY` Int32
`surfaceWidth` Int32
`surfaceHeight` Int32

Event ID 85: DUser_Input85

Provider: Microsoft-Windows-DUSER
Channel: Diagnostic
Task: DUser_Input

Fields #

Name	Description
`PointerHitTestID` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 8429e243-345b-47c1-8a91-2c94caf0daab

Defined in duser.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)