Microsoft-Windows-NCSI

58 events across 2 channels

Event	Title	Channel	Sample
2001	Corporate connectivity check will be skipped.	Analytic	N
2002	Corporate connectivity check is enabled	Analytic	N
2003	Corporate inside/outside location check will be skipped.	Analytic	N
2004	Corporate inside/outside location check is enabled	Analytic	N
4001	Entered State: Interface_Luid Interface Luid: InterfaceGuid.	Analytic	N
4002	Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.	Analytic	N
4003	Entered State: Interface_Luid Interface Luid: InterfaceGuid.	Analytic	N
4004	Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.	Analytic	N
4005	Entered State: Interface_Luid Interface Luid: InterfaceGuid.	Analytic	N
4006	Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.	Analytic	N
4007	Entered State: Interface_Luid Interface Luid: InterfaceGuid.	Analytic	N
4008	Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.	Analytic	N
4009	Inside/Outside detection started for interface IfLuid.	Operational	N
4010	Inside/Outside detection finished for interface IfLuid (CorporateLocation).	Operational	N
4011	Windows Firewall Group Policy settings have been updated.	Operational	N
4012	Inside/Outside probe failed for interface Host.	Operational	N
4013	Active Internet Probe started on interface InterfaceGuid.	Analytic	N
4014	Active Internet Probe finished on interface InterfaceGuid (Succeeded).	Analytic	N
4015	Active Internet Probe (DNS) started on interface InterfaceGuid.	Analytic	N
4016	Active Internet Probe (DNS) finished on interface InterfaceGuid.	Analytic	N
4017	Active Internet Probe (HTTP) started on interface InterfaceGuid.	Analytic	N
4018	Active Internet Probe (HTTP) finished on interface InterfaceGuid.	Analytic	N
4019	Active Corp Probe started on interface InterfaceGuid.	Analytic	N
4020	Active Corp Probe finished on interface InterfaceGuid (Succeeded).	Analytic	N
4021	Active Corp Probe (DNS) started on interface InterfaceGuid.	Analytic	N
4022	Active Corp Probe (DNS) finished on interface InterfaceGuid.	Analytic	N
4023	Active Corp Probe (HTTP) started on interface InterfaceGuid.	Analytic	N
4024	Active Corp Probe (HTTP) finished on interface InterfaceGuid.	Analytic	N
4025	Proxy Detection started	Analytic	N
4026	Proxy Detection stopped (HasProxy=ErrorCode).	Analytic	N
4027	Opportunistic Internet flag on interface InterfaceGuid for family Family marked.	Analytic	N
4028	Inside/Outside detection is suspect	Operational	N
4029	Entered suspect state on interface InterfaceGuid (Family: IfLuid Reason: …	Analytic	N
4030	Suspect state cancelled on interface IfLuid (Family: Family).	Analytic	N
4031	Suspect state expired on interface IfLuid (Family: Family).	Analytic	N
4032	Entered corporate suspect state on interface IfLuid.	Analytic	N
4033	Corporate suspect state cancelled on interface IfLuid.	Analytic	N
4034	Corporate suspect state expired on interface IfLuid.	Analytic	N
4035	Cancelling hotspot detection scenario for interface InterfaceGuid.	Analytic	N
4036	Check Corporate Inside/outside Location	Analytic	N
4037	Starting hotspot detection for family Family on interface IfLuid.	Analytic	N
4038	Hotspot detected on interface IfLuid (Family: Family).	Operational	N
4039	Hotspot not detected on interface IfLuid (Family: Family).	Analytic	N
4040	Interface ConnectedInterfaceGuid (IfLuid) has been connected.	Analytic	N
4041	Interface DisconnectedInterfaceGuid (IfLuid) has been disconnected.	Analytic	N
4042	Capability change on InterfaceGuid (IfLuid Family: Family Capability: Capability …	Operational	Y
4043	Proxied capability change on ProxiedCapability (InterfaceGuid Family: IfLuid …	Analytic	N
4044	Passive Poll state change.	Analytic	N
4045	NetReady update on NetReady (InterfaceGuid Family: IfLuid NetReady: Family).	Analytic	N
4046	Corporate connectivity change on HasCorporateConnectivity (InterfaceGuid Family: …	Analytic	N
4047	Default gateway is set on GatewayIP (GatewayMAC Family: KnownProxyless …	Analytic	N
4048	Next hop to Internet has changed on HasNextHopToInternet (NextHopAddress Family: …	Analytic	N
4049	Preferred address change on HasPreferredAddress (AddressSuffixOrigins Family: …	Analytic	N
4050	Preferred global address change on HasPreferredGlobalAddress …	Analytic	N
4051	Active probe result code on interface InterfaceGuid (IfLuid Family: Family) = …	Analytic	N
4052	Interface diagnostic for IPv6_address (IPv4_capability): IPv4 address: …	Analytic	N
4053	task_04053	Analytic	N
4054	task_04054	Analytic	N

Event ID 2001: Corporate connectivity check will be skipped.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforCorporateConnectivity

Description

Corporate connectivity check will be skipped. Reason: CorpCheckDisabledReason.

Message #

Corporate connectivity check will be skipped. Reason: %1

Fields #

Name	Description
`CorpCheckDisabledReason` UInt8

Event ID 2002: Corporate connectivity check is enabled

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforCorporateConnectivity

Description

Corporate connectivity check is enabled.

Message #

Corporate connectivity check is enabled

Event ID 2003: Corporate inside/outside location check will be skipped.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CheckCorporateInside/outsideLocation

Description

Corporate inside/outside location check will be skipped. Reason: CorpCheckDisabledReason.

Message #

Corporate inside/outside location check will be skipped. Reason: %1

Fields #

Name	Description
`CorpCheckDisabledReason` UInt8

Event ID 2004: Corporate inside/outside location check is enabled

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CheckCorporateInside/outsideLocation

Description

Corporate inside/outside location check is enabled.

Message #

Corporate inside/outside location check is enabled

Event ID 4001: Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforNetReady

Description

Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Message #

Entered State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64

Event ID 4002: Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforNetReady

Description

Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Message #

Transitioning to State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64

Event ID 4003: Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforLocalConnectivity

Description

Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Message #

Entered State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64

Event ID 4004: Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforLocalConnectivity

Description

Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Message #

Transitioning to State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64

Event ID 4005: Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforInternetConnectivity

Description

Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Message #

Entered State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64

Event ID 4006: Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforInternetConnectivity

Description

Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Message #

Transitioning to State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64

Event ID 4007: Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforCorporateConnectivity

Description

Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Message #

Entered State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64

Event ID 4008: Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforCorporateConnectivity

Description

Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Message #

Transitioning to State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64

Event ID 4009: Inside/Outside detection started for interface IfLuid.

Provider: Microsoft-Windows-NCSI
Channel: Operational
Task: CheckCorporateInside/outsideLocation

Description

Inside/Outside detection started for interface IfLuid.

Message #

Inside/Outside detection started for interface %3.

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64

Event ID 4010: Inside/Outside detection finished for interface IfLuid (CorporateLocation).

Provider: Microsoft-Windows-NCSI
Channel: Operational
Task: CheckCorporateInside/outsideLocation

Description

Inside/Outside detection finished for interface IfLuid (CorporateLocation).

Message #

Inside/Outside detection finished for interface %3 (%4).

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64
`CorporateLocation` UInt8
`CorporateLocationMetadata` UInt32

Event ID 4011: Windows Firewall Group Policy settings have been updated.

Provider: Microsoft-Windows-NCSI
Channel: Operational
Task: CheckCorporateInside/outsideLocation

Description

Windows Firewall Group Policy settings have been updated. Triggering another inside/outside location detection.

Message #

Windows Firewall Group Policy settings have been updated. Triggering another inside/outside location detection

Event ID 4012: Inside/Outside probe failed for interface Host.

Provider: Microsoft-Windows-NCSI
Channel: Operational
Task: CheckCorporateInside/outsideLocation

Description

Inside/Outside probe failed for interface Host.

Message #

Inside/Outside probe failed for interface %1.

Error: %6 (%5)
Host: %3/%4
Next retry: %7 second(s).

Fields #

Name	Description
`IfLuid` UInt64
`InterfaceGuid` GUID
`ProbeHost` UnicodeString
`ProbePath` UnicodeString
`ErrorCode` UInt32
`ErrorString` UnicodeString
`RetryInterval` UInt32

Event ID 4013: Active Internet Probe started on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection
Opcode: Start

Description

Active Internet Probe started on interface InterfaceGuid.

Message #

Active Internet Probe started on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID
`ForceWeb` Boolean
`UseProxyCache` Boolean

Event ID 4014: Active Internet Probe finished on interface InterfaceGuid (Succeeded).

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection
Opcode: Stop

Description

Active Internet Probe finished on interface InterfaceGuid (Succeeded).

Message #

Active Internet Probe finished on interface %1 (%2)

Fields #

Name	Description
`InterfaceGuid` GUID
`Succeeded` Boolean
`UsedDnsProbe` Boolean
`UsedProxy` Boolean
`ContentComparison` Boolean
`WebCompleted` Boolean
`WebRedirected` Boolean
`LocalErrorOccured` Boolean

Event ID 4015: Active Internet Probe (DNS) started on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection
Opcode: Start

Description

Active Internet Probe (DNS) started on interface InterfaceGuid.

Message #

Active Internet Probe (DNS) started on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID
`Family` UInt32

Event ID 4016: Active Internet Probe (DNS) finished on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection
Opcode: Stop

Description

Active Internet Probe (DNS) finished on interface InterfaceGuid.

Message #

Active Internet Probe (DNS) finished on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID
`Family` UInt32

Event ID 4017: Active Internet Probe (HTTP) started on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection
Opcode: Start

Description

Active Internet Probe (HTTP) started on interface InterfaceGuid.

Message #

Active Internet Probe (HTTP) started on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID
`Family` UInt32

Event ID 4018: Active Internet Probe (HTTP) finished on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection
Opcode: Stop

Description

Active Internet Probe (HTTP) finished on interface InterfaceGuid.

Message #

Active Internet Probe (HTTP) finished on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID
`Family` UInt32

Event ID 4019: Active Corp Probe started on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CorporateConnectivityDetection
Opcode: Start

Description

Active Corp Probe started on interface InterfaceGuid.

Message #

Active Corp Probe started on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 4020: Active Corp Probe finished on interface InterfaceGuid (Succeeded).

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CorporateConnectivityDetection
Opcode: Stop

Description

Active Corp Probe finished on interface InterfaceGuid (Succeeded).

Message #

Active Corp Probe finished on interface %1 (%2)

Fields #

Name	Description
`InterfaceGuid` GUID
`Succeeded` Boolean

Event ID 4021: Active Corp Probe (DNS) started on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CorporateConnectivityDetection
Opcode: Start

Description

Active Corp Probe (DNS) started on interface InterfaceGuid.

Message #

Active Corp Probe (DNS) started on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 4022: Active Corp Probe (DNS) finished on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CorporateConnectivityDetection
Opcode: Stop

Description

Active Corp Probe (DNS) finished on interface InterfaceGuid.

Message #

Active Corp Probe (DNS) finished on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 4023: Active Corp Probe (HTTP) started on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CorporateConnectivityDetection
Opcode: Start

Description

Active Corp Probe (HTTP) started on interface InterfaceGuid.

Message #

Active Corp Probe (HTTP) started on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 4024: Active Corp Probe (HTTP) finished on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CorporateConnectivityDetection
Opcode: Stop

Description

Active Corp Probe (HTTP) finished on interface InterfaceGuid.

Message #

Active Corp Probe (HTTP) finished on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 4025: Proxy Detection started

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: ProxyDetection
Opcode: Start

Description

Proxy Detection started.

Message #

Proxy Detection started

Event ID 4026: Proxy Detection stopped (HasProxy=ErrorCode).

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: ProxyDetection
Opcode: Stop

Description

Proxy Detection stopped (HasProxy=ErrorCode).

Message #

Proxy Detection stopped (HasProxy=%1)

Fields #

Name	Description
`ErrorCode` UInt32
`Source` UInt8

Event ID 4027: Opportunistic Internet flag on interface InterfaceGuid for family Family marked.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection

Description

Opportunistic Internet flag on interface InterfaceGuid for family Family marked.

Message #

Opportunistic Internet flag on interface %1 for family %2 marked

Fields #

Name	Description
`InterfaceGuid` GUID
`Family` UInt32

Event ID 4028: Inside/Outside detection is suspect

Provider: Microsoft-Windows-NCSI
Channel: Operational
Task: Inside/Outside detection verification

Description

Inside/Outside detection is suspect.

Message #

Inside/Outside detection is suspect

Event ID 4029: Entered suspect state on interface InterfaceGuid (Family: IfLuid Reason: Family).

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: Suspectstate

Description

Entered suspect state on interface InterfaceGuid (Family: IfLuid Reason: Family).

Message #

Entered suspect state on interface %2 (Family: %3 Reason: %4)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32
`SuspectStateReason` UInt8

Event ID 4030: Suspect state cancelled on interface IfLuid (Family: Family).

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: Suspectstate

Description

Suspect state cancelled on interface IfLuid (Family: Family).

Message #

Suspect state cancelled on interface %2 (Family: %3)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32

Event ID 4031: Suspect state expired on interface IfLuid (Family: Family).

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: Suspectstate

Description

Suspect state expired on interface IfLuid (Family: Family).

Message #

Suspect state expired on interface %2 (Family: %3)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32

Event ID 4032: Entered corporate suspect state on interface IfLuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CorporateSuspectstate

Description

Entered corporate suspect state on interface IfLuid.

Message #

Entered corporate suspect state on interface %2

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64

Event ID 4033: Corporate suspect state cancelled on interface IfLuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CorporateSuspectstate

Description

Corporate suspect state cancelled on interface IfLuid.

Message #

Corporate suspect state cancelled on interface %2

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64

Event ID 4034: Corporate suspect state expired on interface IfLuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CorporateSuspectstate

Description

Corporate suspect state expired on interface IfLuid.

Message #

Corporate suspect state expired on interface %2

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64

Event ID 4035: Cancelling hotspot detection scenario for interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection

Description

Cancelling hotspot detection scenario for interface InterfaceGuid.

Message #

Cancelling hotspot detection scenario for interface %1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 4036: Check Corporate Inside/outside Location

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CheckCorporateInside/outsideLocation

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 4037: Starting hotspot detection for family Family on interface IfLuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection

Description

Starting hotspot detection for family Family on interface IfLuid.

Message #

Starting hotspot detection for family %2 on interface %1

Fields #

Name	Description
`IfLuid` UInt64
`Family` UInt32

Event ID 4038: Hotspot detected on interface IfLuid (Family: Family).

Provider: Microsoft-Windows-NCSI
Channel: Operational
Task: InternetConnectivityDetection

Description

Hotspot detected on interface IfLuid (Family: Family).

Message #

Hotspot detected on interface %1 (Family: %2)

Fields #

Name	Description
`IfLuid` UInt64
`Family` UInt32

Event ID 4039: Hotspot not detected on interface IfLuid (Family: Family).

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection

Description

Hotspot not detected on interface IfLuid (Family: Family).

Message #

Hotspot not detected on interface %1 (Family: %2)

Fields #

Name	Description
`IfLuid` UInt64
`Family` UInt32

Event ID 4040: Interface ConnectedInterfaceGuid (IfLuid) has been connected.

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Interface ConnectedInterfaceGuid (IfLuid) has been connected.

Message #

Interface %1 (%2) has been connected

Fields #

Name	Description
`ConnectedInterfaceGuid` GUID
`IfLuid` UInt64

Event ID 4041: Interface DisconnectedInterfaceGuid (IfLuid) has been disconnected.

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Interface DisconnectedInterfaceGuid (IfLuid) has been disconnected.

Message #

Interface %1 (%2) has been disconnected

Fields #

Name	Description
`DisconnectedInterfaceGuid` GUID
`IfLuid` UInt64

Event ID 4042: Capability change on InterfaceGuid (IfLuid Family: Family Capability: Capability ChangeReason: CapabilityChangeReason).

Provider: Microsoft-Windows-NCSI
Channel: Operational
Level: Informational

Description

Capability change on InterfaceGuid (IfLuid Family: Family Capability: Capability ChangeReason: CapabilityChangeReason).

Message #

Capability change on %1 (%2 Family: %3 Capability: %4 ChangeReason: %5)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32	2 Family.
`Capability` UInt32
`CapabilityChangeReason` UInt32	ChangeReason.
`PreviousCapability` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-NCSI",
    "guid": "{314DE49F-CE63-4779-BA2B-D616F6963A88}",
    "event_source_name": "",
    "event_id": 4042,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387936,
    "time_created": "2026-05-29T16:33:35.2696049+00:00",
    "event_record_id": 43,
    "correlation": {},
    "execution": {
      "process_id": 1828,
      "thread_id": 2016
    },
    "channel": "Microsoft-Windows-NCSI/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "InterfaceGuid": "{2a7bd48e-ddc6-4641-9f41-682f29f1d76c}",
    "IfLuid": "1689399632855040",
    "Family": "0",
    "Capability": "2",
    "CapabilityChangeReason": "8",
    "PreviousCapability": "1"
  },
  "message": "Capability change on {2a7bd48e-ddc6-4641-9f41-682f29f1d76c} (0x6008001000000 Family: V4 Capability: Internet ChangeReason: ActiveDnsProbeSucceeded)"
}

Event ID 4043: Proxied capability change on ProxiedCapability (InterfaceGuid Family: IfLuid ProxiedCapability: Family).

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Proxied capability change on ProxiedCapability (InterfaceGuid Family: IfLuid ProxiedCapability: Family).

Message #

Proxied capability change on %1 (%2 Family: %3 ProxiedCapability: %4)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32
`ProxiedCapability` UInt32

Event ID 4044: Passive Poll state change.

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Passive Poll state change (ShouldPassivePollRun: ShouldPassivePollRun WasPassivePollRunning: WasPassivePollRunning IsPassivePollAllowed: IsPassivePollAllowed ClientPresent: ClientPresent UserPresent: UserPresent NetworkQuietMode: NetworkQuietMode DeadUserPollCount: DeadUserPollCount DeadNetPollCountV4: DeadNetPollCountV4 DeadNetPollCountV6: DeadNetPollCountV6)

Message #

Passive Poll state change (ShouldPassivePollRun: %1 WasPassivePollRunning: %2 IsPassivePollAllowed: %3 ClientPresent: %4 UserPresent: %5 NetworkQuietMode: %6 DeadUserPollCount: %7 DeadNetPollCountV4: %8 DeadNetPollCountV6: %9)

Fields #

Name	Description
`ShouldPassivePollRun` Boolean
`WasPassivePollRunning` Boolean
`IsPassivePollAllowed` Boolean
`ClientPresent` Boolean
`UserPresent` Boolean
`NetworkQuietMode` Boolean
`DeadUserPollCount` UInt32
`DeadNetPollCountV4` UInt32
`DeadNetPollCountV6` UInt32

Event ID 4045: NetReady update on NetReady (InterfaceGuid Family: IfLuid NetReady: Family).

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

NetReady update on NetReady (InterfaceGuid Family: IfLuid NetReady: Family).

Message #

NetReady update on %1 (%2 Family: %3 NetReady: %4)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32
`NetReady` Boolean

Event ID 4046: Corporate connectivity change on HasCorporateConnectivity (InterfaceGuid Family: IfLuid HasCorporateConnectivity: Family).

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Corporate connectivity change on HasCorporateConnectivity (InterfaceGuid Family: IfLuid HasCorporateConnectivity: Family).

Message #

Corporate connectivity change on %1 (%2 Family: %3 HasCorporateConnectivity: %4)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32
`HasCorporateConnectivity` Boolean

Event ID 4047: Default gateway is set on GatewayIP (GatewayMAC Family: KnownProxyless GatewayIP: KnownOppInternet GatewayMAC: InterfaceGuid KnownHotspot: IfLuid KnownOppInternet: Family KnownProxiedOppInternet: I...

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Default gateway is set on GatewayIP (GatewayMAC Family: KnownProxyless GatewayIP: KnownOppInternet GatewayMAC: InterfaceGuid KnownHotspot: IfLuid KnownOppInternet: Family KnownProxiedOppInternet: IpAddressLength).

Message #

Default gateway is set on %1 (%2 Family: %3 GatewayIP: %5 GatewayMAC: %7 KnownHotspot: %8 KnownOppInternet: %9 KnownProxiedOppInternet: %10)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32
`IpAddressLength` UInt32
`IpAddress` Binary
`MacAddressLength` UInt32
`MacAddress` Binary
`KnownHotspot` Boolean	GatewayIP.
`KnownOppInternet` Boolean
`KnownProxiedOppInternet` Boolean	GatewayMAC.

Event ID 4048: Next hop to Internet has changed on HasNextHopToInternet (NextHopAddress Family: InterfaceGuid HasNextHopToInternet: IfLuid NextHopAddress: NextHopAddressLength).

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Next hop to Internet has changed on HasNextHopToInternet (NextHopAddress Family: InterfaceGuid HasNextHopToInternet: IfLuid NextHopAddress: NextHopAddressLength).

Message #

Next hop to Internet has changed on %1 (%2 Family: %3 HasNextHopToInternet: %4 NextHopAddress: %6)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32
`HasNextHopToInternet` Boolean
`NextHopAddressLength` UInt32
`NextHopAddress` Binary	2 Family.

Event ID 4049: Preferred address change on HasPreferredAddress (AddressSuffixOrigins Family: InterfaceGuid HasPreferredAddress: IfLuid AddressSuffixOrigins: Family).

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Preferred address change on HasPreferredAddress (AddressSuffixOrigins Family: InterfaceGuid HasPreferredAddress: IfLuid AddressSuffixOrigins: Family).

Message #

Preferred address change on %1 (%2 Family: %3 HasPreferredAddress: %4 AddressSuffixOrigins: %5)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32
`HasPreferredAddress` Boolean
`AddressSuffixOrigins` UInt32	2 Family.

Event ID 4050: Preferred global address change on HasPreferredGlobalAddress (AddressSuffixOrigins Family: InterfaceGuid HasPreferredGlobalAddress: IfLuid AddressSuffixOrigins: Family).

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Preferred global address change on HasPreferredGlobalAddress (AddressSuffixOrigins Family: InterfaceGuid HasPreferredGlobalAddress: IfLuid AddressSuffixOrigins: Family).

Message #

Preferred global address change on %1 (%2 Family: %3 HasPreferredGlobalAddress: %4 AddressSuffixOrigins: %5)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32
`HasPreferredGlobalAddress` Boolean
`AddressSuffixOrigins` UInt32	2 Family.

Event ID 4051: Active probe result code on interface InterfaceGuid (IfLuid Family: Family) = ActiveProbeResultCode.

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Active probe result code on interface InterfaceGuid (IfLuid Family: Family) = ActiveProbeResultCode.

Message #

Active probe result code on interface %1 (%2 Family: %3) = %4

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32
`ActiveProbeResultCode` UInt32

Event ID 4052: Interface diagnostic for IPv6_address (IPv4_capability): IPv4 address: IPv6_capability, IPv6 address: IPv4_test_used, IPv4 capability: IPv6_test_used, IPv6 capability: InterfaceGuid, IPv4 test used...

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Interface diagnostic for IPv6_address (IPv4_capability): IPv4 address: IPv6_capability, IPv6 address: IPv4_test_used, IPv4 capability: IPv6_test_used, IPv6 capability: InterfaceGuid, IPv4 test used: IfLuid, IPv6 test used: HasPreferredGlobalAddressIPv4.

Message #

Interface diagnostic for %1 (%2): IPv4 address: %3, IPv6 address: %4, IPv4 capability: %5, IPv6 capability: %6, IPv4 test used: %7, IPv6 test used: %8

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`HasPreferredGlobalAddressIPv4` Boolean
`HasPreferredGlobalAddressIPv6` Boolean
`InternetCapabilityIPv4` UInt8
`InternetCapabilityIPv6` UInt8
`InternetTestIPv4` UInt8
`InternetTestIPv6` UInt8

Event ID 4053: task_04053

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Fields #

Name	Description
`InterfaceGuid` GUID
`Family` UInt32

Event ID 4054: task_04054

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Fields #

Name	Description
`InterfaceGuid` GUID
`Family` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 314de49f-ce63-4779-ba2b-d616f6963a88

Defined in ncsi.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)