Microsoft.Windows.Hyper-V.VmSwitch

Title	Sample	Rule
ExtProtocol NetPnpEvent End	Y	N
Ioctl Begin	Y	N
SwitchCreateError	Y	N
Ioctl End	Y	N
ExtProtocol NetPnpEvent Begin	Y	N

ExtProtocol NetPnpEvent End

Level: 4

Description

ExtProtocol NetPnpEvent End. MDE sensor-internal TraceLogging event (sample-derived, no registered manifest).

Fields #

Name	Description
`Status`
`delta (100 ns)`
`netPnpEvent`
`switchFriendlyName`
`switchName`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 9900
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Hyper-V.VmSwitch",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 21:32:09.268Z",
    "version": 0
  },
  "event_data": {
    "Status": 0,
    "delta (100 ns)": 758,
    "netPnpEvent": "NetEventBindFailed",
    "switchFriendlyName": "0000",
    "switchName": "0000"
  },
  "message": ""
}

Ioctl Begin

Level: 4

Description

Ioctl Begin. MDE sensor-internal TraceLogging event (sample-derived, no registered manifest).

Fields #

Name	Description
`ioctlCode`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3908,
      "thread_id": 10692
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Hyper-V.VmSwitch",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 21:32:08.986Z",
    "version": 0
  },
  "event_data": {
    "ioctlCode": "1F080000"
  },
  "message": ""
}

SwitchCreateError

Level: 4

Description

SwitchCreateError. MDE sensor-internal TraceLogging event (sample-derived, no registered manifest).

Fields #

Name	Description
`PartA_PrivTags`
`ntStatus`
`switchName`
`uniqueEventValue`
`updateConfiguration`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3908,
      "thread_id": 10692
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Hyper-V.VmSwitch",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 21:32:09.303Z",
    "version": 0
  },
  "event_data": {
    "PartA_PrivTags": 2048,
    "ntStatus": -1073741771,
    "switchName": "4800430030003800430042003700420038002D0039004200330043002D0034003000380045002D0038004500330030002D00350045003100360041003300410045004200340034003400",
    "uniqueEventValue": 50,
    "updateConfiguration": 0
  },
  "message": ""
}

Ioctl End

Level: 4

Description

Ioctl End. MDE sensor-internal TraceLogging event (sample-derived, no registered manifest).

Fields #

Name	Description
`delta (100 ns)`
`ioctlCode`
`ntStatus`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3908,
      "thread_id": 10692
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Hyper-V.VmSwitch",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 21:32:08.986Z",
    "version": 0
  },
  "event_data": {
    "delta (100 ns)": 455,
    "ioctlCode": "1F080000",
    "ntStatus": 0
  },
  "message": ""
}

ExtProtocol NetPnpEvent Begin

Level: 4

Description

ExtProtocol NetPnpEvent Begin. MDE sensor-internal TraceLogging event (sample-derived, no registered manifest).

Fields #

Name	Description
`netPnpEvent`
`switchFriendlyName`
`switchName`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 9900
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Hyper-V.VmSwitch",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 21:32:09.268Z",
    "version": 0
  },
  "event_data": {
    "netPnpEvent": "NetEventBindFailed",
    "switchFriendlyName": "0000",
    "switchName": "0000"
  },
  "message": ""
}