Microsoft-Windows-Kernel-WDI

14 events across 3 channels

Event	Title	Channel	Sample
32	The Scenario Event Mapper started a scenario for provider ProviderID (event ID …	Analytic	N
33	The Scenario Event Mapper stopped a scenario for provider ProviderID (event ID …	Analytic	N
34	An in-flight scenario from provider ProviderID (event ID EventID) timed out and …	Analytic	N
35	The Scenario Event Mapper was unable to start a new scenario for provider …	Debug	N
36	The Scenario Event Mapper was unable to start a scenario for provider ProviderID …	Debug	N
37	The Scenario Event Mapper was unable to stop a scenario for provider ProviderID …	Debug	N
38	The Scenario Event Mapper is configured with more than the maximum number of …	Operational	N
39	The Scenario Event Mapper is configured with more than the maximum number of …	Operational	N
40	The Scenario Event Mapper is configured with more than the maximum number of end …	Operational	N
41	The Scenario Event Mapper is configured with more than the maximum number of …	Operational	N
42	The Scenario Event Mapper is configured with an unsupported scenario.	Operational	N
43	task_0	Operational	N
44	task_044	Operational	N
45	task_045	Operational	N

Event ID 32: The Scenario Event Mapper started a scenario for provider ProviderID (event ID EventID) with ActionCount context providers.

Provider: Microsoft-Windows-Kernel-WDI
Channel: Analytic
Task: SEMScenarioLifecycle
Opcode: ScenariostartenablescontextproviderstotheWDIcontextlogger.

Description

The Scenario Event Mapper started a scenario for provider ProviderID (event ID EventID) with ActionCount context providers. The context logger dropped event count was DroppedEventCount.

Message #

The Scenario Event Mapper started a scenario for provider %1 (event ID %2) with %4 context providers.  The context logger dropped event count was %3.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16
`DroppedEventCount` UInt32
`ActionCount` UInt8
`SemActions` Int16

Event ID 33: The Scenario Event Mapper stopped a scenario for provider ProviderID (event ID EventID) with ActionCount context providers.

Provider: Microsoft-Windows-Kernel-WDI
Channel: Analytic
Task: SEMScenarioLifecycle
Opcode: ScenarioenddisablescontextproviderstotheWDIcontextlogger.

Description

The Scenario Event Mapper stopped a scenario for provider ProviderID (event ID EventID) with ActionCount context providers. The context logger dropped event count was DroppedEventCount.

Message #

The Scenario Event Mapper stopped a scenario for provider %1 (event ID %2) with %4 context providers.  The context logger dropped event count was %3.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16
`DroppedEventCount` UInt32
`ActionCount` UInt8
`SemActions` Int16

Event ID 34: An in-flight scenario from provider ProviderID (event ID EventID) timed out and was stopped automatically by the Scenario Event Mapper.

Provider: Microsoft-Windows-Kernel-WDI
Channel: Analytic
Task: SEMScenarioLifecycle
Opcode: Whenascenariohasremainedin_flightbeyondthemaximumtimewindowitisautomaticallyterminatedbytheSEM.

Description

An in-flight scenario from provider ProviderID (event ID EventID) timed out and was stopped automatically by the Scenario Event Mapper.

Message #

An in-flight scenario from provider %1 (event ID %2) timed out and was stopped automatically by the Scenario Event Mapper.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16

Event ID 35: The Scenario Event Mapper was unable to start a new scenario for provider ProviderID (event ID EventID) because the maximum number of scenarios are already in f...

Provider: Microsoft-Windows-Kernel-WDI
Channel: Debug
Task: SEMScenarioLifecycle
Opcode: TheSEMreceivedarequesttostartanewscenario,butthemaximumnumberofscenarioswerealreadyin_flight.

Description

The Scenario Event Mapper was unable to start a new scenario for provider ProviderID (event ID EventID) because the maximum number of scenarios are already in flight.

Message #

The Scenario Event Mapper was unable to start a new scenario for provider %1 (event ID %2) because the maximum number of scenarios are already in flight.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16
`ScenarioCount` UInt8
`ScenarioInflightItems` UInt8

Event ID 36: The Scenario Event Mapper was unable to start a scenario for provider ProviderID (event ID EventID).

Provider: Microsoft-Windows-Kernel-WDI
Channel: Debug
Task: SEMScenarioLifecycle
Opcode: AscenariostartattemptfailedintheSEM.

Description

The Scenario Event Mapper was unable to start a scenario for provider ProviderID (event ID EventID). The error code was NTStatus.

Message #

The Scenario Event Mapper was unable to start a scenario for provider %1 (event ID %2).  The error code was %3.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16
`NTStatus` UInt32	NTSTATUS reference

Event ID 37: The Scenario Event Mapper was unable to stop a scenario for provider ProviderID (event ID EventID).

Provider: Microsoft-Windows-Kernel-WDI
Channel: Debug
Task: SEMScenarioLifecycle
Opcode: AscenarioendattemptfailedintheSEM.

Description

The Scenario Event Mapper was unable to stop a scenario for provider ProviderID (event ID EventID). The error code was NTStatus.

Message #

The Scenario Event Mapper was unable to stop a scenario for provider %1 (event ID %2).  The error code was %3.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16
`NTStatus` UInt32	NTSTATUS reference

Event ID 38: The Scenario Event Mapper is configured with more than the maximum number of scenarios.

Provider: Microsoft-Windows-Kernel-WDI
Channel: Operational
Task: SEMInitialization
Opcode: TheSEMisconfiguredwithmorescenariosthanthemaximumallowedcount.

Description

The Scenario Event Mapper is configured with more than the maximum number of scenarios. The scenario for provider ProviderID (event ID EventID) will be ignored.

Message #

The Scenario Event Mapper is configured with more than the maximum number of scenarios.  The scenario for provider %1 (event ID %2) will be ignored.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16

Event ID 39: The Scenario Event Mapper is configured with more than the maximum number of context providers for the scenario with provider ProviderID (event ID EventID).

Provider: Microsoft-Windows-Kernel-WDI
Channel: Operational
Task: SEMInitialization
Opcode: TheSEMisconfiguredwithascenariowithtoomanycontextproviders.

Description

The Scenario Event Mapper is configured with more than the maximum number of context providers for the scenario with provider ProviderID (event ID EventID). The scenario will be ignored.

Message #

The Scenario Event Mapper is configured with more than the maximum number of context providers for the scenario with provider %1 (event ID %2).  The scenario will be ignored.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16

Event ID 40: The Scenario Event Mapper is configured with more than the maximum number of end events for the scenario with provider ProviderID (event ID EventID).

Provider: Microsoft-Windows-Kernel-WDI
Channel: Operational
Task: SEMInitialization
Opcode: TheSEMisconfiguredwithascenariothathastoomanyendevents.

Description

The Scenario Event Mapper is configured with more than the maximum number of end events for the scenario with provider ProviderID (event ID EventID). The scenario will be ignored.

Message #

The Scenario Event Mapper is configured with more than the maximum number of end events for the scenario with provider %1 (event ID %2).  The scenario will be ignored.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16

Event ID 41: The Scenario Event Mapper is configured with more than the maximum number of providers.

Provider: Microsoft-Windows-Kernel-WDI
Channel: Operational
Task: SEMInitialization
Opcode: Thenumberofprovidersspecifiedacrossallscenariosisabovethemaximumallowedamount.

Description

The Scenario Event Mapper is configured with more than the maximum number of providers. The provider ProviderID will be ignored.

Message #

The Scenario Event Mapper is configured with more than the maximum number of providers.  The provider %1 will be ignored.

Fields #

Name	Description
`ProviderID` GUID

Event ID 42: The Scenario Event Mapper is configured with an unsupported scenario.

Provider: Microsoft-Windows-Kernel-WDI
Channel: Operational
Task: SEMInitialization
Opcode: ThereisaninvalidconfigurationparameterintheSEMregistrynamespace.

Description

The Scenario Event Mapper is configured with an unsupported scenario. The scenario for provider ProviderID (event ID EventID) encountered error code NTStatus and will be ignored.

Message #

The Scenario Event Mapper is configured with an unsupported scenario. The scenario for provider %1 (event ID %2) encountered error code %3 and will be ignored.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16
`NTStatus` UInt32	NTSTATUS reference

Event ID 43: task_0

Provider: Microsoft-Windows-Kernel-WDI
Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSid` SID

Event ID 44: task_044

Provider: Microsoft-Windows-Kernel-WDI
Channel: Operational

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 45: task_045

Provider: Microsoft-Windows-Kernel-WDI
Channel: Operational

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmStreamRowLength` UInt32
`SqmStreamRow` Int16

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 2ff3e6b7-cb90-4700-9621-443f389734ed

Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-Kernel-WDI

Event ID 32: The Scenario Event Mapper started a scenario for provider ProviderID (event ID EventID) with ActionCount context providers.

Description

Message #

Fields #

Event ID 33: The Scenario Event Mapper stopped a scenario for provider ProviderID (event ID EventID) with ActionCount context providers.

Description

Message #

Fields #

Event ID 34: An in-flight scenario from provider ProviderID (event ID EventID) timed out and was stopped automatically by the Scenario Event Mapper.

Description

Message #

Fields #

Event ID 35: The Scenario Event Mapper was unable to start a new scenario for provider ProviderID (event ID EventID) because the maximum number of scenarios are already in f...

Description

Message #

Fields #

Event ID 36: The Scenario Event Mapper was unable to start a scenario for provider ProviderID (event ID EventID).

Description

Message #

Fields #

Event ID 37: The Scenario Event Mapper was unable to stop a scenario for provider ProviderID (event ID EventID).

Description

Message #

Fields #

Event ID 38: The Scenario Event Mapper is configured with more than the maximum number of scenarios.

Description

Message #

Fields #

Event ID 39: The Scenario Event Mapper is configured with more than the maximum number of context providers for the scenario with provider ProviderID (event ID EventID).

Description

Message #

Fields #

Event ID 40: The Scenario Event Mapper is configured with more than the maximum number of end events for the scenario with provider ProviderID (event ID EventID).

Description

Message #

Fields #

Event ID 41: The Scenario Event Mapper is configured with more than the maximum number of providers.

Description

Message #

Fields #

Event ID 42: The Scenario Event Mapper is configured with an unsupported scenario.

Description

Message #

Fields #

Event ID 43: task_0

Fields #

Event ID 44: task_044

Fields #

Event ID 45: task_045

Fields #

Provenance

Downloads