Microsoft-Windows-HAL

20 events across 2 channels

Event	Title	Channel	Sample
1	Initialization of the High Precision Event Timer failed due to a BIOS …	System	N
2	Initialization of the High Precision Event Timer failed due to unsupported …	System	N
3	Initialization of the High Precision Event Timer failed due to an interrupt …	System	N
4	Due to an unexpected condition, the operating system will use another available …	System	N
5	Due to an expected condition, the operating system will use another available …	Debug	N
7	The processor cycle counter on processor TargetProcessor has been probed by …	Debug	N
8	The processor's cycle counters have been successfully synchronized from …	Debug	N
9	The processor cycle counter on processor TargetProcessor was synchronized …	Debug	N
10	The synchronization of the processor's cycle counters was not able to …	Debug	N
11	The High Precision Event Timer failed to deliver message signalled interrupts.	System	N
12	The platform firmware has corrupted memory across the previous system power …	System	N
13	The system watchdog timer was triggered.	System	N
14	The watchdog wake timer was triggered.	Debug	N
15	The iommu has detected an error.	System	N
16	IOMMU fault reporting has been initialized.	System	Y
17	The clock interrupt is backed by a platform timer instead of a per-processor …	System	N
18	The performance counter is not readable from user mode.	System	N
19	DMA API failure detected.	System	N
20	The hardware real-time clock was not queried because evaluation of the ACPI Time …	System	N
21	The hardware real-time clock was not set because evaluation of the ACPI Time and …	System	N

Event ID 1: Initialization of the High Precision Event Timer failed due to a BIOS configuration problem.

Provider: Microsoft-Windows-HAL
Channel: System

Description

Initialization of the High Precision Event Timer failed due to a BIOS configuration problem.

Message #

Initialization of the High Precision Event Timer failed due to a BIOS configuration problem.
The operating system will use another available platform timer in lieu of the High Precision Event Timer.

Contact your system vendor for technical assistance.
Initialization status: %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 2: Initialization of the High Precision Event Timer failed due to unsupported hardware.

Provider: Microsoft-Windows-HAL
Channel: System

Description

Initialization of the High Precision Event Timer failed due to unsupported hardware.

Message #

Initialization of the High Precision Event Timer failed due to unsupported hardware.
The operating system will use another available platform timer in lieu of the High Precision Event Timer.

Initialization status: %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 3: Initialization of the High Precision Event Timer failed due to an interrupt configuration problem.

Provider: Microsoft-Windows-HAL
Channel: System

Description

Initialization of the High Precision Event Timer failed due to an interrupt configuration problem.

Message #

Initialization of the High Precision Event Timer failed due to an interrupt configuration problem.
The operating system will use another available platform timer in lieu of the High Precision Event Timer.

It may be possible to address this problem with an updated system BIOS.
Contact your system vendor for technical assistance.
Initialization status: %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 4: Due to an unexpected condition, the operating system will use another available platform timer in lieu of the processor's cycle counters.

Provider: Microsoft-Windows-HAL
Channel: System

Description

Due to an unexpected condition, the operating system will use another available platform timer in lieu of the processor's cycle counters. Status: Status.

Message #

Due to an unexpected condition, the operating system will use another available platform timer in lieu of the processor's cycle counters.  Status: %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 5: Due to an expected condition, the operating system will use another available platform timer in lieu of the processor's cycle counters.

Provider: Microsoft-Windows-HAL
Channel: Debug

Description

Due to an expected condition, the operating system will use another available platform timer in lieu of the processor's cycle counters. Status: Status.

Message #

Due to an expected condition, the operating system will use another available platform timer in lieu of the processor's cycle counters.  Status: %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 7: The processor cycle counter on processor TargetProcessor has been probed by processor LeadProcessor.

Provider: Microsoft-Windows-HAL
Channel: Debug

Description

The processor cycle counter on processor TargetProcessor has been probed by processor LeadProcessor. A counter delta of Delta was detected. The approximate communication delay between these processors was detected to be NopCycles.

Message #

The processor cycle counter on processor %2 has been probed by processor %1.  A counter delta of %3 was detected.  The approximate communication delay between these processors was detected to be %4.

Fields #

Name	Description
`LeadProcessor` Int32
`TargetProcessor` Int32
`Delta` Int64
`NopCycles` UInt32

Event ID 8: The processor's cycle counters have been successfully synchronized from processor LeadProcessor within acceptable operating thresholds.

Provider: Microsoft-Windows-HAL
Channel: Debug

Description

The processor's cycle counters have been successfully synchronized from processor LeadProcessor within acceptable operating thresholds. The maximum positive delta detected was MaximumPositiveDelta and the maximum negative delta was MaximumNegativeDelta. Synchronization executed for Microseconds microseconds.

Message #

The processor's cycle counters have been successfully synchronized from processor %1 within acceptable operating thresholds.  The maximum positive delta detected was %3 and the maximum negative delta was %4.  Synchronization executed for %5 microseconds.

Fields #

Name	Description
`LeadProcessor` Int32
`MaximumPositiveDeltaProcessor` Int32
`MaximumPositiveDelta` Int32
`MaximumNegativeDelta` Int32
`Microseconds` Int32

Event ID 9: The processor cycle counter on processor TargetProcessor was synchronized against processor SourceProcessor using an adjustment of Bias cycles on attempt Wave.

Provider: Microsoft-Windows-HAL
Channel: Debug

Description

The processor cycle counter on processor TargetProcessor was synchronized against processor SourceProcessor using an adjustment of Bias cycles on attempt Wave. This resulted in a delta of Delta cycles.

Message #

The processor cycle counter on processor %2 was synchronized against processor %1 using an adjustment of %4 cycles on attempt %5.  This resulted in a delta of %3 cycles.

Fields #

Name	Description
`SourceProcessor` Int32
`TargetProcessor` Int32
`Delta` Int64
`Bias` Int64
`Wave` UInt32

Event ID 10: The synchronization of the processor's cycle counters was not able to synchronize the processors within acceptable operating thresholds.

Provider: Microsoft-Windows-HAL
Channel: Debug

Description

The synchronization of the processor's cycle counters was not able to synchronize the processors within acceptable operating thresholds. Status: Status.

Message #

The synchronization of the processor's cycle counters was not able to synchronize the processors within acceptable operating thresholds.  Status: %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 11: The High Precision Event Timer failed to deliver message signalled interrupts.

Provider: Microsoft-Windows-HAL
Channel: System

Description

The High Precision Event Timer failed to deliver message signalled interrupts. The operating system will fall back to line based interrupts for this timer.

Message #

The High Precision Event Timer failed to deliver message signalled interrupts.  The operating system will fall back to line based interrupts for this timer.
Initialization status: %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 12: The platform firmware has corrupted memory across the previous system power transition.

Provider: Microsoft-Windows-HAL
Channel: System

Description

The platform firmware has corrupted memory across the previous system power transition. Please check for updated firmware for your system.

Message #

The platform firmware has corrupted memory across the previous system power transition.  Please check for updated firmware for your system.

Fields #

Name	Description
`Count` UInt32
`FirstPage` UInt32
`LastPage` UInt32

Event ID 13: The system watchdog timer was triggered.

Provider: Microsoft-Windows-HAL
Channel: System

Description

The system watchdog timer was triggered.

Message #

The system watchdog timer was triggered.

Event ID 14: The watchdog wake timer was triggered.

Provider: Microsoft-Windows-HAL
Channel: Debug

Description

The watchdog wake timer was triggered.

Message #

The watchdog wake timer was triggered.

Event ID 15: The iommu has detected an error.

Provider: Microsoft-Windows-HAL
Channel: System

Description

The IOMMU has detected an error.

Message #

The IOMMU has detected an error.

Device: %1
FaultInformation: %2
FaultReason: %3
ExtendedData: %4

Fields #

Name	Description
`SourceId` UInt64
`FaultInformation` UInt64
`FaultReason` UInt32
`ExtendedData` UInt64

Event ID 16: IOMMU fault reporting has been initialized.

Provider: Microsoft-Windows-HAL
Channel: System
Level: Informational

Description

IOMMU fault reporting has been initialized.

Message #

IOMMU fault reporting has been initialized.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HAL",
    "guid": "{63D1E632-95CC-4443-9312-AF927761D52A}",
    "event_source_name": "",
    "event_id": 16,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-29T16:32:44.0620303+00:00",
    "event_record_id": 6668,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8
    },
    "channel": "System",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "The iommu fault reporting has been initialized."
}

Event ID 17: The clock interrupt is backed by a platform timer instead of a per-processor source.

Provider: Microsoft-Windows-HAL
Channel: System

Description

The clock interrupt is backed by a platform timer instead of a per-processor source. System performance may be degraded.

Message #

The clock interrupt is backed by a platform timer instead of a per-processor source.  System performance may be degraded.

Event ID 18: The performance counter is not readable from user mode.

Provider: Microsoft-Windows-HAL
Channel: System

Description

The performance counter is not readable from user mode. System performance may be degraded.

Message #

The performance counter is not readable from user mode.  System performance may be degraded.

Event ID 19: DMA API failure detected.

Provider: Microsoft-Windows-HAL
Channel: System

Description

DMA API failure detected.

Message #

DMA API failure detected.

APIIndex: %1
ErrorCode: %2
FailureInformation1: %3
FailureInformation2: %4

Fields #

Name	Description
`APIIndex` UInt32
`ErrorCode` UInt32
`FailureInformation1` UInt64
`FailureInformation2` UInt64

Event ID 20: The hardware real-time clock was not queried because evaluation of the ACPI Time and Alarm Device method failed.

Provider: Microsoft-Windows-HAL
Channel: System

Description

The hardware real-time clock was not queried because evaluation of the ACPI Time and Alarm Device method failed. Status: Status.

Message #

The hardware real-time clock was not queried because evaluation of the ACPI Time and Alarm Device method failed.  Status: %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 21: The hardware real-time clock was not set because evaluation of the ACPI Time and Alarm Device method failed.

Provider: Microsoft-Windows-HAL
Channel: System

Description

The hardware real-time clock was not set because evaluation of the ACPI Time and Alarm Device method failed. Status: Status.

Message #

The hardware real-time clock was not set because evaluation of the ACPI Time and Alarm Device method failed.  Status: %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 63d1e632-95cc-4443-9312-af927761d52a

Defined in microsoft-windows-hal-events.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-HAL

Event ID 1: Initialization of the High Precision Event Timer failed due to a BIOS configuration problem.

Description

Message #

Fields #

Event ID 2: Initialization of the High Precision Event Timer failed due to unsupported hardware.

Description

Message #

Fields #

Event ID 3: Initialization of the High Precision Event Timer failed due to an interrupt configuration problem.

Description

Message #

Fields #

Event ID 4: Due to an unexpected condition, the operating system will use another available platform timer in lieu of the processor's cycle counters.

Description

Message #

Fields #

Event ID 5: Due to an expected condition, the operating system will use another available platform timer in lieu of the processor's cycle counters.

Description

Message #

Fields #

Event ID 7: The processor cycle counter on processor TargetProcessor has been probed by processor LeadProcessor.

Description

Message #

Fields #

Event ID 8: The processor's cycle counters have been successfully synchronized from processor LeadProcessor within acceptable operating thresholds.

Description

Message #

Fields #

Event ID 9: The processor cycle counter on processor TargetProcessor was synchronized against processor SourceProcessor using an adjustment of Bias cycles on attempt Wave.

Description

Message #

Fields #

Event ID 10: The synchronization of the processor's cycle counters was not able to synchronize the processors within acceptable operating thresholds.

Description

Message #

Fields #

Event ID 11: The High Precision Event Timer failed to deliver message signalled interrupts.

Description

Message #

Fields #

Event ID 12: The platform firmware has corrupted memory across the previous system power transition.

Description

Message #

Fields #

Event ID 13: The system watchdog timer was triggered.

Description

Message #

Event ID 14: The watchdog wake timer was triggered.

Description

Message #

Event ID 15: The iommu has detected an error.

Description

Message #

Fields #

Event ID 16: IOMMU fault reporting has been initialized.

Description

Message #

Example Event #

Event ID 17: The clock interrupt is backed by a platform timer instead of a per-processor source.

Description

Message #

Event ID 18: The performance counter is not readable from user mode.

Description

Message #

Event ID 19: DMA API failure detected.

Description

Message #

Fields #

Event ID 20: The hardware real-time clock was not queried because evaluation of the ACPI Time and Alarm Device method failed.

Description

Message #

Fields #

Event ID 21: The hardware real-time clock was not set because evaluation of the ACPI Time and Alarm Device method failed.

Description

Message #

Fields #

Provenance

Downloads