detection.wiki

Microsoft-Windows-FunctionDiscovery

EventTitleChannelSampleRule
1000Begin IFunctionDiscovery::GetInstanceCollection().AnalyticNN
1001End IFunctionDiscovery::GetInstanceCollection().AnalyticNN
1002Begin IFunctionDiscovery::GetInstance().AnalyticNN
1003End IFunctionDiscovery::GetInstance().AnalyticNN
1004Begin IFunctionDiscovery::CreateInstanceCollectionQuery().AnalyticNN
1005End IFunctionDiscovery::CreateInstanceCollectionQuery().AnalyticNN
1006Begin IFunctionDiscovery::CreateInstanceQuery().AnalyticNN
1007End IFunctionDiscovery::CreateInstanceQuery().AnalyticNN
1008Begin IFunctionDiscovery::AddInstance().AnalyticNN
1009End IFunctionDiscovery::AddInstance().AnalyticNN
1010Begin IFunctionDiscovery::RemoveInstance().AnalyticNN
1011End IFunctionDiscovery::RemoveInstance().AnalyticNN
1012Begin IFunctionInstanceCollectionQuery::Execute().AnalyticNN
1013End IFunctionInstanceCollectionQuery::Execute().AnalyticNN
1014Begin IFunctionInstanceCollectionQuery2::Advise().AnalyticNN
1015End IFunctionInstanceCollectionQuery2::Advise().AnalyticNN
1016Begin IFunctionInstanceCollectionQuery2::Unadvise().AnalyticNN
1017End IFunctionInstanceCollectionQuery2::Unadvise().AnalyticNN
1018Begin IFunctionInstanceCollectionQuery2::Start().AnalyticNN
1019End IFunctionInstanceCollectionQuery2::Start().AnalyticNN
1020Begin IFunctionInstanceCollectionQuery2::Stop().AnalyticNN
1021End IFunctionInstanceCollectionQuery2::Stop().AnalyticNN
1022Begin IFunctionInstanceCollectionQuery2::QueryService().AnalyticNN
1023End IFunctionInstanceCollectionQuery2::QueryService().AnalyticNN
1024Begin IFunctionInstanceQuery::Execute().AnalyticNN
1025End IFunctionInstanceQuery::Execute().AnalyticNN
1026Begin IFunctionDiscoveryProvider::Initialize().AnalyticNN
1027End IFunctionDiscoveryProvider::Initialize().AnalyticNN
1028Begin IFunctionDiscoveryProvider::Query().AnalyticNN
1029End IFunctionDiscoveryProvider::Query().AnalyticNN
1030Begin IFunctionDiscoveryProvider::EndQuery().AnalyticNN
1031End IFunctionDiscoveryProvider::EndQuery().AnalyticNN
1032Begin IFunctionDiscoveryProvider::InstancePropertyStoreValidateAccess().AnalyticNN
1033End IFunctionDiscoveryProvider::InstancePropertyStoreValidateAccess().AnalyticNN
1034Begin IFunctionDiscoveryProvider::InstancePropertyStoreOpen().AnalyticNN
1035End IFunctionDiscoveryProvider::InstancePropertyStoreOpen().AnalyticNN
1036Begin IFunctionDiscoveryProvider::InstancePropertyStoreFlush().AnalyticNN
1037End IFunctionDiscoveryProvider::InstancePropertyStoreFlush().AnalyticNN
1038Begin IFunctionDiscoveryProvider::InstanceQueryService().AnalyticNN
1039End IFunctionDiscoveryProvider::InstanceQueryService().AnalyticNN
1040Begin IFunctionDiscoveryProvider::InstanceReleased().AnalyticNN
1041End IFunctionDiscoveryProvider::InstanceReleased().AnalyticNN
1042Begin IProviderPublishing::CreateInstance().AnalyticNN
1043End IProviderPublishing::CreateInstance().AnalyticNN
1044Begin IProviderPublishing::RemoveInstance().AnalyticNN
1045End IProviderPublishing::RemoveInstance().AnalyticNN
1046Begin Provider IServiceProvider::QueryService().AnalyticNN
1047End Provider IServiceProvider::QueryService().AnalyticNN
1048Begin Provider IProviderProperties::GetCount().AnalyticNN
1049End Provider IProviderProperties::GetCount().AnalyticNN
1050Begin Provider IProviderProperties::GetAt().AnalyticNN
1051End Provider IProviderProperties::GetAt().AnalyticNN
1052Begin Provider IProviderProperties::GetValue().AnalyticNN
1053End Provider IProviderProperties::GetValue().AnalyticNN
1054Begin Provider IProviderProperties::SetValue().AnalyticNN
1055End Provider IProviderProperties::SetValue().AnalyticNN
1056Begin asyncronous query.AnalyticNN
1057Asynchronous query complete.AnalyticNN

Event ID 1000: Begin IFunctionDiscovery::GetInstanceCollection().

#
Channel
Analytic
Task
FunDisc_GetInstanceCollection
Opcode
Start

Description

Begin IFunctionDiscovery::GetInstanceCollection(). Category: Begin_IFunctionDiscoveryGetInstanceCollection__Category.

Message #

Begin IFunctionDiscovery::GetInstanceCollection().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString
IncludeSubcategories Boolean

Event ID 1001: End IFunctionDiscovery::GetInstanceCollection().

#
Channel
Analytic
Task
FunDisc_GetInstanceCollection
Opcode
Stop

Description

End IFunctionDiscovery::GetInstanceCollection(). Category: End_IFunctionDiscoveryGetInstanceCollection__Category.

Message #

End IFunctionDiscovery::GetInstanceCollection().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString
IncludeSubcategories Boolean

Event ID 1002: Begin IFunctionDiscovery::GetInstance().

#
Channel
Analytic
Task
FunDisc_GetInstance
Opcode
Start

Description

Begin IFunctionDiscovery::GetInstance(). FIID: Begin_IFunctionDiscoveryGetInstance__FIID.

Message #

Begin IFunctionDiscovery::GetInstance().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString

Event ID 1003: End IFunctionDiscovery::GetInstance().

#
Channel
Analytic
Task
FunDisc_GetInstance
Opcode
Stop

Description

End IFunctionDiscovery::GetInstance(). FIID: End_IFunctionDiscoveryGetInstance__FIID.

Message #

End IFunctionDiscovery::GetInstance().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString

Event ID 1004: Begin IFunctionDiscovery::CreateInstanceCollectionQuery().

#
Channel
Analytic
Task
FunDisc_CreateInstanceCollectionQuery
Opcode
Start

Description

Begin IFunctionDiscovery::CreateInstanceCollectionQuery(). Category: Begin_IFunctionDiscoveryCreateInstanceCollectionQuery__Category.

Message #

Begin IFunctionDiscovery::CreateInstanceCollectionQuery().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString
IncludeSubcategories Boolean

Event ID 1005: End IFunctionDiscovery::CreateInstanceCollectionQuery().

#
Channel
Analytic
Task
FunDisc_CreateInstanceCollectionQuery
Opcode
Stop

Description

End IFunctionDiscovery::CreateInstanceCollectionQuery(). Category: End_IFunctionDiscoveryCreateInstanceCollectionQuery__Category.

Message #

End IFunctionDiscovery::CreateInstanceCollectionQuery().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString
IncludeSubcategories Boolean

Event ID 1006: Begin IFunctionDiscovery::CreateInstanceQuery().

#
Channel
Analytic
Task
FunDisc_CreateInstanceQuery
Opcode
Start

Description

Begin IFunctionDiscovery::CreateInstanceQuery(). FIID: Begin_IFunctionDiscoveryCreateInstanceQuery__FIID.

Message #

Begin IFunctionDiscovery::CreateInstanceQuery().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString

Event ID 1007: End IFunctionDiscovery::CreateInstanceQuery().

#
Channel
Analytic
Task
FunDisc_CreateInstanceQuery
Opcode
Stop

Description

End IFunctionDiscovery::CreateInstanceQuery(). FIID: End_IFunctionDiscoveryCreateInstanceQuery__FIID.

Message #

End IFunctionDiscovery::CreateInstanceQuery().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString

Event ID 1008: Begin IFunctionDiscovery::AddInstance().

#
Channel
Analytic
Task
FunDisc_AddInstance
Opcode
Start

Description

Begin IFunctionDiscovery::AddInstance(). Category: Begin_IFunctionDiscoveryAddInstance__Category.

Message #

Begin IFunctionDiscovery::AddInstance().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString
ProviderInstanceID UnicodeString

Event ID 1009: End IFunctionDiscovery::AddInstance().

#
Channel
Analytic
Task
FunDisc_AddInstance
Opcode
Stop

Description

End IFunctionDiscovery::AddInstance(). Category: End_IFunctionDiscoveryAddInstance__Category.

Message #

End IFunctionDiscovery::AddInstance().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString
ProviderInstanceID UnicodeString

Event ID 1010: Begin IFunctionDiscovery::RemoveInstance().

#
Channel
Analytic
Task
FunDisc_RemoveInstance
Opcode
Start

Description

Begin IFunctionDiscovery::RemoveInstance(). Category: Begin_IFunctionDiscoveryRemoveInstance__Category.

Message #

Begin IFunctionDiscovery::RemoveInstance().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString
ProviderInstanceID UnicodeString

Event ID 1011: End IFunctionDiscovery::RemoveInstance().

#
Channel
Analytic
Task
FunDisc_RemoveInstance
Opcode
Stop

Description

End IFunctionDiscovery::RemoveInstance(). Category: End_IFunctionDiscoveryRemoveInstance__Category.

Message #

End IFunctionDiscovery::RemoveInstance().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString
ProviderInstanceID UnicodeString

Event ID 1012: Begin IFunctionInstanceCollectionQuery::Execute().

#
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryExecute
Opcode
Start

Description

Begin IFunctionInstanceCollectionQuery::Execute(). Category: Begin_IFunctionInstanceCollectionQueryExecute__Category.

Message #

Begin IFunctionInstanceCollectionQuery::Execute().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1013: End IFunctionInstanceCollectionQuery::Execute().

#
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryExecute
Opcode
Stop

Description

End IFunctionInstanceCollectionQuery::Execute(). Category: End_IFunctionInstanceCollectionQueryExecute__Category.

Message #

End IFunctionInstanceCollectionQuery::Execute().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1014: Begin IFunctionInstanceCollectionQuery2::Advise().

#
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryAdvise
Opcode
Start

Description

Begin IFunctionInstanceCollectionQuery2::Advise(). Category: Begin_IFunctionInstanceCollectionQuery2Advise__Category.

Message #

Begin IFunctionInstanceCollectionQuery2::Advise().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1015: End IFunctionInstanceCollectionQuery2::Advise().

#
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryAdvise
Opcode
Stop

Description

End IFunctionInstanceCollectionQuery2::Advise(). Category: End_IFunctionInstanceCollectionQuery2Advise__Category.

Message #

End IFunctionInstanceCollectionQuery2::Advise().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1016: Begin IFunctionInstanceCollectionQuery2::Unadvise().

#
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryUnadvise
Opcode
Start

Description

Begin IFunctionInstanceCollectionQuery2::Unadvise(). Category: Begin_IFunctionInstanceCollectionQuery2Unadvise__Category.

Message #

Begin IFunctionInstanceCollectionQuery2::Unadvise().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1017: End IFunctionInstanceCollectionQuery2::Unadvise().

#
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryUnadvise
Opcode
Stop

Description

End IFunctionInstanceCollectionQuery2::Unadvise(). Category: End_IFunctionInstanceCollectionQuery2Unadvise__Category.

Message #

End IFunctionInstanceCollectionQuery2::Unadvise().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1018: Begin IFunctionInstanceCollectionQuery2::Start().

#
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryStart
Opcode
Start

Description

Begin IFunctionInstanceCollectionQuery2::Start(). Category: Begin_IFunctionInstanceCollectionQuery2Start__Category.

Message #

Begin IFunctionInstanceCollectionQuery2::Start().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1019: End IFunctionInstanceCollectionQuery2::Start().

#
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryStart
Opcode
Stop

Description

End IFunctionInstanceCollectionQuery2::Start(). Category: End_IFunctionInstanceCollectionQuery2Start__Category.

Message #

End IFunctionInstanceCollectionQuery2::Start().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1020: Begin IFunctionInstanceCollectionQuery2::Stop().

#
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryStop
Opcode
Start

Description

Begin IFunctionInstanceCollectionQuery2::Stop(). Category: Begin_IFunctionInstanceCollectionQuery2Stop__Category.

Message #

Begin IFunctionInstanceCollectionQuery2::Stop().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1021: End IFunctionInstanceCollectionQuery2::Stop().

#
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryStop
Opcode
Stop

Description

End IFunctionInstanceCollectionQuery2::Stop(). Category: End_IFunctionInstanceCollectionQuery2Stop__Category.

Message #

End IFunctionInstanceCollectionQuery2::Stop().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1022: Begin IFunctionInstanceCollectionQuery2::QueryService().

#
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryQueryService
Opcode
Start

Description

Begin IFunctionInstanceCollectionQuery2::QueryService(). Category: Begin_IFunctionInstanceCollectionQuery2QueryService__Category.

Message #

Begin IFunctionInstanceCollectionQuery2::QueryService().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1023: End IFunctionInstanceCollectionQuery2::QueryService().

#
Channel
Analytic
Task
FunDisc_FunctionInstanceCollectionQueryQueryService
Opcode
Stop

Description

End IFunctionInstanceCollectionQuery2::QueryService(). Category: End_IFunctionInstanceCollectionQuery2QueryService__Category.

Message #

End IFunctionInstanceCollectionQuery2::QueryService().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1024: Begin IFunctionInstanceQuery::Execute().

#
Channel
Analytic
Task
FunDisc_FunctionInstanceQueryExecute
Opcode
Start

Description

Begin IFunctionInstanceQuery::Execute(). Category: Begin_IFunctionInstanceQueryExecute__Category.

Message #

Begin IFunctionInstanceQuery::Execute().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1025: End IFunctionInstanceQuery::Execute().

#
Channel
Analytic
Task
FunDisc_FunctionInstanceQueryExecute
Opcode
Stop

Description

End IFunctionInstanceQuery::Execute(). Category: End_IFunctionInstanceQueryExecute__Category.

Message #

End IFunctionInstanceQuery::Execute().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1026: Begin IFunctionDiscoveryProvider::Initialize().

#
Channel
Analytic
Task
FunDisc_ProviderInitialize
Opcode
Start

Description

Begin IFunctionDiscoveryProvider::Initialize(). Category: Begin_IFunctionDiscoveryProviderInitialize__Category.

Message #

Begin IFunctionDiscoveryProvider::Initialize().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1027: End IFunctionDiscoveryProvider::Initialize().

#
Channel
Analytic
Task
FunDisc_ProviderInitialize
Opcode
Stop

Description

End IFunctionDiscoveryProvider::Initialize(). Category: End_IFunctionDiscoveryProviderInitialize__Category.

Message #

End IFunctionDiscoveryProvider::Initialize().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1028: Begin IFunctionDiscoveryProvider::Query().

#
Channel
Analytic
Task
FunDisc_ProviderQuery
Opcode
Start

Description

Begin IFunctionDiscoveryProvider::Query(). Category: Begin_IFunctionDiscoveryProviderQuery__Category.

Message #

Begin IFunctionDiscoveryProvider::Query().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1029: End IFunctionDiscoveryProvider::Query().

#
Channel
Analytic
Task
FunDisc_ProviderQuery
Opcode
Stop

Description

End IFunctionDiscoveryProvider::Query(). Category: End_IFunctionDiscoveryProviderQuery__Category.

Message #

End IFunctionDiscoveryProvider::Query().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1030: Begin IFunctionDiscoveryProvider::EndQuery().

#
Channel
Analytic
Task
FunDisc_ProviderEndQuery
Opcode
Start

Description

Begin IFunctionDiscoveryProvider::EndQuery(). Category: Begin_IFunctionDiscoveryProviderEndQuery__Category.

Message #

Begin IFunctionDiscoveryProvider::EndQuery().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1031: End IFunctionDiscoveryProvider::EndQuery().

#
Channel
Analytic
Task
FunDisc_ProviderEndQuery
Opcode
Stop

Description

End IFunctionDiscoveryProvider::EndQuery(). Category: End_IFunctionDiscoveryProviderEndQuery__Category.

Message #

End IFunctionDiscoveryProvider::EndQuery().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1032: Begin IFunctionDiscoveryProvider::InstancePropertyStoreValidateAccess().

#
Channel
Analytic
Task
FunDisc_ProviderInstancePropertyStoreValidateAccess
Opcode
Start

Description

Begin IFunctionDiscoveryProvider::InstancePropertyStoreValidateAccess(). FIID: Begin_IFunctionDiscoveryProviderInstancePropertyStoreValidateAccess__FIID.

Message #

Begin IFunctionDiscoveryProvider::InstancePropertyStoreValidateAccess().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString

Event ID 1033: End IFunctionDiscoveryProvider::InstancePropertyStoreValidateAccess().

#
Channel
Analytic
Task
FunDisc_ProviderInstancePropertyStoreValidateAccess
Opcode
Stop

Description

End IFunctionDiscoveryProvider::InstancePropertyStoreValidateAccess(). FIID: End_IFunctionDiscoveryProviderInstancePropertyStoreValidateAccess__FIID.

Message #

End IFunctionDiscoveryProvider::InstancePropertyStoreValidateAccess().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString

Event ID 1034: Begin IFunctionDiscoveryProvider::InstancePropertyStoreOpen().

#
Channel
Analytic
Task
FunDisc_ProviderInstancePropertyStoreOpen
Opcode
Start

Description

Begin IFunctionDiscoveryProvider::InstancePropertyStoreOpen(). FIID: Begin_IFunctionDiscoveryProviderInstancePropertyStoreOpen__FIID.

Message #

Begin IFunctionDiscoveryProvider::InstancePropertyStoreOpen().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString

Event ID 1035: End IFunctionDiscoveryProvider::InstancePropertyStoreOpen().

#
Channel
Analytic
Task
FunDisc_ProviderInstancePropertyStoreOpen
Opcode
Stop

Description

End IFunctionDiscoveryProvider::InstancePropertyStoreOpen(). FIID: End_IFunctionDiscoveryProviderInstancePropertyStoreOpen__FIID.

Message #

End IFunctionDiscoveryProvider::InstancePropertyStoreOpen().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString

Event ID 1036: Begin IFunctionDiscoveryProvider::InstancePropertyStoreFlush().

#
Channel
Analytic
Task
FunDisc_ProviderInstancePropertyStoreFlush
Opcode
Start

Description

Begin IFunctionDiscoveryProvider::InstancePropertyStoreFlush(). FIID: Begin_IFunctionDiscoveryProviderInstancePropertyStoreFlush__FIID.

Message #

Begin IFunctionDiscoveryProvider::InstancePropertyStoreFlush().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString

Event ID 1037: End IFunctionDiscoveryProvider::InstancePropertyStoreFlush().

#
Channel
Analytic
Task
FunDisc_ProviderInstancePropertyStoreFlush
Opcode
Stop

Description

End IFunctionDiscoveryProvider::InstancePropertyStoreFlush(). FIID: End_IFunctionDiscoveryProviderInstancePropertyStoreFlush__FIID.

Message #

End IFunctionDiscoveryProvider::InstancePropertyStoreFlush().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString

Event ID 1038: Begin IFunctionDiscoveryProvider::InstanceQueryService().

#
Channel
Analytic
Task
FunDisc_ProviderInstanceQueryService
Opcode
Start

Description

Begin IFunctionDiscoveryProvider::InstanceQueryService(). FIID: Begin_IFunctionDiscoveryProviderInstanceQueryService__FIID.

Message #

Begin IFunctionDiscoveryProvider::InstanceQueryService().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString

Event ID 1039: End IFunctionDiscoveryProvider::InstanceQueryService().

#
Channel
Analytic
Task
FunDisc_ProviderInstanceQueryService
Opcode
Stop

Description

End IFunctionDiscoveryProvider::InstanceQueryService(). FIID: End_IFunctionDiscoveryProviderInstanceQueryService__FIID.

Message #

End IFunctionDiscoveryProvider::InstanceQueryService().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString

Event ID 1040: Begin IFunctionDiscoveryProvider::InstanceReleased().

#
Channel
Analytic
Task
FunDisc_ProviderInstanceReleased
Opcode
Start

Description

Begin IFunctionDiscoveryProvider::InstanceReleased(). FIID: Begin_IFunctionDiscoveryProviderInstanceReleased__FIID.

Message #

Begin IFunctionDiscoveryProvider::InstanceReleased().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString

Event ID 1041: End IFunctionDiscoveryProvider::InstanceReleased().

#
Channel
Analytic
Task
FunDisc_ProviderInstanceReleased
Opcode
Stop

Description

End IFunctionDiscoveryProvider::InstanceReleased(). FIID: End_IFunctionDiscoveryProviderInstanceReleased__FIID.

Message #

End IFunctionDiscoveryProvider::InstanceReleased().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString

Event ID 1042: Begin IProviderPublishing::CreateInstance().

#
Channel
Analytic
Task
FunDisc_ProviderPublishingCreateInstance
Opcode
Start

Description

Begin IProviderPublishing::CreateInstance(). Category: Begin_IProviderPublishingCreateInstance__Category.

Message #

Begin IProviderPublishing::CreateInstance().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString
ProviderInstanceID UnicodeString

Event ID 1043: End IProviderPublishing::CreateInstance().

#
Channel
Analytic
Task
FunDisc_ProviderPublishingCreateInstance
Opcode
Stop

Description

End IProviderPublishing::CreateInstance(). Category: End_IProviderPublishingCreateInstance__Category.

Message #

End IProviderPublishing::CreateInstance().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString
ProviderInstanceID UnicodeString

Event ID 1044: Begin IProviderPublishing::RemoveInstance().

#
Channel
Analytic
Task
FunDisc_ProviderPublishingRemoveInstance
Opcode
Start

Description

Begin IProviderPublishing::RemoveInstance(). Category: Begin_IProviderPublishingRemoveInstance__Category.

Message #

Begin IProviderPublishing::RemoveInstance().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString
ProviderInstanceID UnicodeString

Event ID 1045: End IProviderPublishing::RemoveInstance().

#
Channel
Analytic
Task
FunDisc_ProviderPublishingRemoveInstance
Opcode
Stop

Description

End IProviderPublishing::RemoveInstance(). Category: End_IProviderPublishingRemoveInstance__Category.

Message #

End IProviderPublishing::RemoveInstance().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString
ProviderInstanceID UnicodeString

Event ID 1046: Begin Provider IServiceProvider::QueryService().

#
Channel
Analytic
Task
FunDisc_ProviderQueryService
Opcode
Start

Description

Begin Provider IServiceProvider::QueryService(). Category: Category.

Message #

Begin Provider IServiceProvider::QueryService().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1047: End Provider IServiceProvider::QueryService().

#
Channel
Analytic
Task
FunDisc_ProviderQueryService
Opcode
Stop

Description

End Provider IServiceProvider::QueryService(). Category: Category.

Message #

End Provider IServiceProvider::QueryService().  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString

Event ID 1048: Begin Provider IProviderProperties::GetCount().

#
Channel
Analytic
Task
FunDisc_ProviderPropertiesGetCount
Opcode
Start

Description

Begin Provider IProviderProperties::GetCount(). FIID: FunctionInstanceID.

Message #

Begin Provider IProviderProperties::GetCount().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString

Event ID 1049: End Provider IProviderProperties::GetCount().

#
Channel
Analytic
Task
FunDisc_ProviderPropertiesGetCount
Opcode
Stop

Description

End Provider IProviderProperties::GetCount(). FIID: FunctionInstanceID.

Message #

End Provider IProviderProperties::GetCount().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString

Event ID 1050: Begin Provider IProviderProperties::GetAt().

#
Channel
Analytic
Task
FunDisc_ProviderPropertiesGetAt
Opcode
Start

Description

Begin Provider IProviderProperties::GetAt(). FIID: FunctionInstanceID.

Message #

Begin Provider IProviderProperties::GetAt().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString

Event ID 1051: End Provider IProviderProperties::GetAt().

#
Channel
Analytic
Task
FunDisc_ProviderPropertiesGetAt
Opcode
Stop

Description

End Provider IProviderProperties::GetAt(). FIID: FunctionInstanceID.

Message #

End Provider IProviderProperties::GetAt().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString

Event ID 1052: Begin Provider IProviderProperties::GetValue().

#
Channel
Analytic
Task
FunDisc_PropertiesGetValue
Opcode
Start

Description

Begin Provider IProviderProperties::GetValue(). FIID: FunctionInstanceID.

Message #

Begin Provider IProviderProperties::GetValue().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString
fmtid GUID
pid HexInt32

Event ID 1053: End Provider IProviderProperties::GetValue().

#
Channel
Analytic
Task
FunDisc_PropertiesGetValue
Opcode
Stop

Description

End Provider IProviderProperties::GetValue(). FIID: FunctionInstanceID.

Message #

End Provider IProviderProperties::GetValue().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString
fmtid GUID
pid HexInt32

Event ID 1054: Begin Provider IProviderProperties::SetValue().

#
Channel
Analytic
Task
FunDisc_PropertiesSetValue
Opcode
Start

Description

Begin Provider IProviderProperties::SetValue(). FIID: FunctionInstanceID.

Message #

Begin Provider IProviderProperties::SetValue().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString
fmtid GUID
pid HexInt32

Event ID 1055: End Provider IProviderProperties::SetValue().

#
Channel
Analytic
Task
FunDisc_PropertiesSetValue
Opcode
Stop

Description

End Provider IProviderProperties::SetValue(). FIID: FunctionInstanceID.

Message #

End Provider IProviderProperties::SetValue().  FIID: %1

Fields #

NameDescription
FunctionInstanceID UnicodeString
fmtid GUID
pid HexInt32

Event ID 1056: Begin asyncronous query.

#
Channel
Analytic
Task
FunDisc_AsyncQuery
Opcode
Start

Description

Begin asyncronous query. Category: Begin_asyncronous_query__Category.

Message #

Begin asyncronous query.  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString
querycookie UInt64

Event ID 1057: Asynchronous query complete.

#
Channel
Analytic
Task
FunDisc_AsyncQuery
Opcode
Stop

Description

Asynchronous query complete. Category: Asynchronous_query_complete__Category.

Message #

Asynchronous query complete.  Category: %1

Fields #

NameDescription
Category UnicodeString
Subcategory UnicodeString
querycookie UInt64

Provenance

ETW provider GUID 9db0fdb5-3b21-440e-a94b-63738a4be5de

Defined in fundisc.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB