Microsoft-Windows-Ndu

23 events across 1 channel

Event	Title	Channel	Sample
2001	_DebugString.	Diagnostic	Y
2002	_FunctionName Failed with _Status.	Diagnostic	N
2003	Interface (Luid:Interface_Luid) added to per-interface list for proc _IfLuid at …	Diagnostic	Y
2004	established_ExePath Flow (Id:SvcTag) established.	Diagnostic	Y
2005	Flow Context (Flow Id:Flow_Context_Flow_Id) Refcount_FlowHandle.	Diagnostic	Y
2006	Updated Interface Stats IfLuid:Updated_Interface_Stats_IfLuid …	Diagnostic	Y
2007	Updated Flow Stats (Flow Id:Updated_Flow_Stats_Flow_Id) IfLuid:IfLuid …	Diagnostic	Y
2008	Registration for quota exceeded notification.	Diagnostic	N
2009	Unregistered from quota exceeded notification.	Diagnostic	N
2010	Registration for byte count limit.	Diagnostic	N
2011	Unregistered from byte count limit notification.	Diagnostic	N
2012	_DebugString.	Diagnostic	Y
2013	_DebugString.	Diagnostic	N
2014	IfLuid:IfLuid ProfileId:ProfileId BytesSent:BytesSent BytesRecvd:BytesRecvd …	Diagnostic	Y
2015	NduPowerDebug	Diagnostic	Y
2016	NduPowerQueueWorkItem	Diagnostic	Y
2017	NduMergeSmbStatsList: Not transferred InterfaceLuid and ProfileId to Smb stats …	Diagnostic	N
2018	ProfileIdTracker::GetProfileIdForInterface: Profile Id not found.	Diagnostic	N
2019	NduGetHostSid::UMgrEnumerateSessionUsers could not find SessionId: _SessionId.	Diagnostic	N
2020	NduUpdateProcessStatsForContainerOrVmId succeeded: …	Diagnostic	N
2021	OuterProcessId: VirtualIfLuid:IfAlias OuterProcessId:Title …	Diagnostic	N
2022	Wake count updated IfLuid:IfLuid Flow Id:FlowHandle (0 means interface) …	Diagnostic	N
2023	Event ID 2023	Diagnostic	N

Event ID 2001: _DebugString.

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: NduDebugTrace
Opcode: win:Info

Description

_DebugString

Message #

%1

Fields #

Name	Description
`_DebugString` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Ndu",
    "guid": "{DF271536-4298-45E1-B0F2-E88F78619C5D}",
    "event_source_name": "",
    "event_id": 2001,
    "version": 0,
    "level": 4,
    "task": 1001,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:59:00.005+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{72529F65-EE0F-0001-46A2-52720FEEDC01}"
    },
    "execution": {
      "process_id": 3824,
      "thread_id": 11304
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "_DebugString": "Found matching service tag in service map"
  },
  "message": "TaskNduDebugTrace"
}

Event ID 2002: _FunctionName Failed with _Status.

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Task: NduDebugTrace

Description

_FunctionName Failed with _Status.

Message #

%1 Failed with %2

Fields #

Name	Description
`_FunctionName` UnicodeString
`_Status` UInt32

Event ID 2003: Interface (Luid:Interface_Luid) added to per-interface list for proc _IfLuid at active index _ProcNum.

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: PerInterfaceStats
Opcode: win:Info

Description

Interface (Luid:Interface_Luid) added to per-interface list for proc _IfLuid at active index _ProcNum.

Message #

Interface (Luid:%1) added to per-interface list for proc %2 at active index %3

Fields #

Name	Description
`_IfLuid` UInt64
`_ProcNum` UInt32
`_ListIndex` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Ndu",
    "guid": "{DF271536-4298-45E1-B0F2-E88F78619C5D}",
    "event_source_name": "",
    "event_id": 2003,
    "version": 0,
    "level": 4,
    "task": 1002,
    "opcode": 0,
    "keywords": "0x0000000000000002",
    "time_created": "2026-06-02T05:59:00.247+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{DF271536-4298-45E1-B0F2-E88F78619C5D}"
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "_IfLuid": 1689399632855040,
    "_ListIndex": 0,
    "_ProcNum": 2
  },
  "message": "TaskNduPerInterfaceStats"
}

Event ID 2004: established_ExePath Flow (Id:SvcTag) established.

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: PerFlowStats
Opcode: win:Info

Description

established_ExePath Flow (Id:SvcTag) established. ExePath: PkgName SvcTag:UserId PkgName:Pid UserId:_Direction Pid: _FlowHandle.

Message #

%1 Flow (Id:%2) established. ExePath: %3 SvcTag:%4 PkgName:%5 UserId:%6 Pid: %7

Fields #

Name	Description
`_Direction` UnicodeString
`_FlowHandle` UInt64
`_ExePath` UnicodeString
`_SvcTag` UInt32
`_PkgName` UnicodeString
`_UserId` SID
`_Pid` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Ndu",
    "guid": "{DF271536-4298-45E1-B0F2-E88F78619C5D}",
    "event_source_name": "",
    "event_id": 2004,
    "version": 0,
    "level": 4,
    "task": 1003,
    "opcode": 0,
    "keywords": "0x0000000000000004",
    "time_created": "2026-06-02T05:59:07.101+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{DF271536-4298-45E1-B0F2-E88F78619C5D}"
    },
    "execution": {
      "process_id": 9180,
      "thread_id": 3556
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "_Direction": "Inbound",
    "_ExePath": "System",
    "_FlowHandle": 31775,
    "_Pid": 4,
    "_PkgName": "NULL",
    "_SvcTag": 0,
    "_UserId": "NT AUTHORITY\\SYSTEM"
  },
  "message": "TaskNduPerFlowStats"
}

Event ID 2005: Flow Context (Flow Id:Flow_Context_Flow_Id) Refcount_FlowHandle.

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: PerFlowStats
Opcode: win:Info

Description

Flow Context (Flow Id:Flow_Context_Flow_Id) Refcount_FlowHandle.

Message #

Flow Context (Flow Id:%1) Refcount%2

Fields #

Name	Description
`_FlowHandle` UInt64
`_RefDeref` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Ndu",
    "guid": "{DF271536-4298-45E1-B0F2-E88F78619C5D}",
    "event_source_name": "",
    "event_id": 2005,
    "version": 0,
    "level": 5,
    "task": 1003,
    "opcode": 0,
    "keywords": "0x0000000000000004",
    "time_created": "2026-06-02T05:59:00.246+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{DF271536-4298-45E1-B0F2-E88F78619C5D}"
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "_FlowHandle": 31717,
    "_RefDeref": "++"
  },
  "message": "TaskNduPerFlowStats"
}

Event ID 2006: Updated Interface Stats IfLuid:Updated_Interface_Stats_IfLuid ProfileId:ProfileId BytesSent:BytesSent BytesRecvd:BytesRecvd.

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: PerInterfaceStats
Opcode: win:Info

Description

Updated Interface Stats IfLuid:Updated_Interface_Stats_IfLuid ProfileId:ProfileId BytesSent:BytesSent BytesRecvd:BytesRecvd.

Message #

Updated Interface Stats IfLuid:%1 ProfileId:%2 BytesSent:%3 BytesRecvd:%4

Fields #

Name	Description
`_IfLuid` UInt64
`_ProfileId` UInt32
`_BytesSent` UInt32
`_BytesRecvd` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Ndu",
    "guid": "{DF271536-4298-45E1-B0F2-E88F78619C5D}",
    "event_source_name": "",
    "event_id": 2006,
    "version": 0,
    "level": 5,
    "task": 1002,
    "opcode": 0,
    "keywords": "0x0000000000000002",
    "time_created": "2026-06-02T05:59:00.247+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{DF271536-4298-45E1-B0F2-E88F78619C5D}"
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "_BytesRecvd": 292,
    "_BytesSent": 0,
    "_IfLuid": 1689399632855040,
    "_ProfileId": 0
  },
  "message": "TaskNduPerInterfaceStats"
}

Event ID 2007: Updated Flow Stats (Flow Id:Updated_Flow_Stats_Flow_Id) IfLuid:IfLuid BytesSent:BytesSent BytesRecvd:BytesRecvd.

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: PerFlowStats
Opcode: win:Info

Description

Updated Flow Stats (Flow Id:Updated_Flow_Stats_Flow_Id) IfLuid:IfLuid BytesSent:BytesSent BytesRecvd:BytesRecvd.

Message #

Updated Flow Stats (Flow Id:%2) IfLuid:%1 BytesSent:%3 BytesRecvd:%4

Fields #

Name	Description
`_IfLuid` UInt64
`_FlowHandle` UInt64
`_BytesSent` UInt32
`_BytesRecvd` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Ndu",
    "guid": "{DF271536-4298-45E1-B0F2-E88F78619C5D}",
    "event_source_name": "",
    "event_id": 2007,
    "version": 0,
    "level": 5,
    "task": 1003,
    "opcode": 0,
    "keywords": "0x0000000000000004",
    "time_created": "2026-06-02T05:59:00.247+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{DF271536-4298-45E1-B0F2-E88F78619C5D}"
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "_BytesRecvd": 292,
    "_BytesSent": 0,
    "_FlowHandle": 31717,
    "_IfLuid": 1689399632855040
  },
  "message": "TaskNduPerFlowStats"
}

Event ID 2008: Registration for quota exceeded notification.

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Task: TokenTracking

Description

Registration for quota exceeded notification. ExePath: _ExePath SvcTag:_SvcTag PkgName:_PkgName UserId:_UserId Cookie: _Cookie Quota: _Quota.

Message #

Registration for quota exceeded notification. ExePath: %1 SvcTag:%2 PkgName:%3 UserId:%4 Cookie: %5 Quota: %6

Fields #

Name	Description
`_ExePath` UnicodeString
`_SvcTag` UInt32
`_PkgName` UnicodeString
`_UserId` SID
`_Cookie` UInt32
`_Quota` UInt32

Event ID 2009: Unregistered from quota exceeded notification.

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Task: TokenTracking

Description

Unregistered from quota exceeded notification. Cookie: _Cookie.

Message #

Unregistered from quota exceeded notification. Cookie: %1

Fields #

Name	Description
`_Cookie` UInt32

Event ID 2010: Registration for byte count limit.

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Task: PerInterfaceStats

Description

Registration for byte count limit. Luid: _IfLuid ProfileId:_ProfileId Limit: _BytesLimit.

Message #

Registration for byte count limit. Luid: %1 ProfileId:%2 Limit: %3

Fields #

Name	Description
`_IfLuid` UInt64
`_ProfileId` UInt32
`_BytesLimit` UInt64

Event ID 2011: Unregistered from byte count limit notification.

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Task: PerInterfaceStats

Description

Unregistered from byte count limit notification. Luid: _IfLuid ProfileId:_ProfileId.

Message #

Unregistered from byte count limit notification. Luid: %1 ProfileId:%2

Fields #

Name	Description
`_IfLuid` UInt64
`_ProfileId` UInt32

Event ID 2012: _DebugString.

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: NduDebugTrace
Opcode: win:Info

Description

_DebugString

Message #

%1

Fields #

Name	Description
`_DebugString` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Ndu",
    "guid": "{DF271536-4298-45E1-B0F2-E88F78619C5D}",
    "event_source_name": "",
    "event_id": 2012,
    "version": 0,
    "level": 5,
    "task": 1001,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:59:00.001+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{72529F65-EE0F-0001-46A2-52720FEEDC01}"
    },
    "execution": {
      "process_id": 3824,
      "thread_id": 11304
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "_DebugString": "==> NduProvQueryStats"
  },
  "message": "TaskNduDebugTrace"
}

Event ID 2013: _DebugString.

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Task: NduDebugTrace

Description

_DebugString

Message #

%1

Fields #

Name	Description
`_DebugString` UnicodeString

Event ID 2014: IfLuid:IfLuid ProfileId:ProfileId BytesSent:BytesSent BytesRecvd:BytesRecvd IsCosted: IsCosted.

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: PerInterfaceStats
Opcode: win:Info

Description

IfLuid:IfLuid ProfileId:ProfileId BytesSent:BytesSent BytesRecvd:BytesRecvd IsCosted: IsCosted.

Message #

IfLuid:%1 ProfileId:%2 BytesSent:%3 BytesRecvd:%4 IsCosted: %5

Fields #

Name	Description
`_IfLuid` UInt64
`_ProfileId` UInt32
`_BytesSent` UInt64
`_BytesRecvd` UInt64
`_IsCosted` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Ndu",
    "guid": "{DF271536-4298-45E1-B0F2-E88F78619C5D}",
    "event_source_name": "",
    "event_id": 2014,
    "version": 0,
    "level": 4,
    "task": 1002,
    "opcode": 0,
    "keywords": "0x0000000000000010",
    "time_created": "2026-06-02T05:59:00.005+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{72529F65-EE0F-0001-46A2-52720FEEDC01}"
    },
    "execution": {
      "process_id": 3824,
      "thread_id": 11304
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "_BytesRecvd": 0,
    "_BytesSent": 315,
    "_IfLuid": 1689399632855040,
    "_IsCosted": false,
    "_ProfileId": 0
  },
  "message": "TaskNduPerInterfaceStats"
}

Event ID 2015: NduPowerDebug

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: NduPowerDebug
Opcode: win:Info

Fields #

Name	Description
`_IfLuid` UInt64
`TimeSinceLast` UInt64
`Energy` UInt64
`CurrentProc` UInt32
`BytesTxRx` UInt32
`Pid` UInt32
`IfMediaType` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Ndu",
    "guid": "{DF271536-4298-45E1-B0F2-E88F78619C5D}",
    "event_source_name": "",
    "event_id": 2015,
    "version": 0,
    "level": 4,
    "task": 1005,
    "opcode": 0,
    "keywords": "0x0000000000000020",
    "time_created": "2026-06-02T05:59:00.247+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{DF271536-4298-45E1-B0F2-E88F78619C5D}"
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "BytesTxRx": 292,
    "CurrentProc": 2,
    "Energy": 61658100,
    "IfMediaType": 1,
    "Pid": 4,
    "TimeSinceLast": 1128,
    "_IfLuid": 1689399632855040
  },
  "message": "TaskNduPowerDebug"
}

Event ID 2016: NduPowerQueueWorkItem

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: NduPowerQueueWorkItem
Opcode: win:Info

Fields #

Name	Description
`ProcId` UInt32
`Count` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Ndu",
    "guid": "{DF271536-4298-45E1-B0F2-E88F78619C5D}",
    "event_source_name": "",
    "event_id": 2016,
    "version": 0,
    "level": 4,
    "task": 1006,
    "opcode": 0,
    "keywords": "0x0000000000000020",
    "time_created": "2026-06-02T05:59:00.247+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{DF271536-4298-45E1-B0F2-E88F78619C5D}"
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Count": 0,
    "ProcId": 2
  },
  "message": "TaskNduPowerQueueWorkItem"
}

Event ID 2017: NduMergeSmbStatsList: Not transferred InterfaceLuid and ProfileId to Smb stats because there is no one-and-only-one file transfer service (SMB) in ...

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Task: NduDebugTrace

Description

NduMergeSmbStatsList: Not transferred InterfaceLuid and ProfileId to Smb stats because there is no one-and-only-one file transfer service (SMB) in the system. SystemSMB count:_SystemSmbCount InContainer:_IsContainer.

Message #

NduMergeSmbStatsList: Not transferred InterfaceLuid and ProfileId to Smb stats because there is no one-and-only-one file transfer service (SMB) in the system. SystemSMB count:%1 InContainer:%2;

Fields #

Name	Description
`_SystemSmbCount` UInt64
`_IsContainer` Boolean

Event ID 2018: ProfileIdTracker::GetProfileIdForInterface: Profile Id not found.

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Task: NduDebugTrace

Description

ProfileIdTracker::GetProfileIdForInterface: Profile Id not found. Luid: _IfLuid.

Message #

ProfileIdTracker::GetProfileIdForInterface: Profile Id not found. Luid: %1

Fields #

Name	Description
`_IfLuid` UInt64

Event ID 2019: NduGetHostSid::UMgrEnumerateSessionUsers could not find SessionId: _SessionId.

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Task: NduDebugTrace

Description

NduGetHostSid::UMgrEnumerateSessionUsers could not find SessionId: _SessionId.

Message #

NduGetHostSid::UMgrEnumerateSessionUsers could not find SessionId: %1

Fields #

Name	Description
`_SessionId` UInt64

Event ID 2020: NduUpdateProcessStatsForContainerOrVmId succeeded: CurrentProcNumber:NduUpdateProcessStatsForContainerOrVmId_succeeded_CurrentProcNumber PartitionId:PartitionId Direction:Direction IfLuid:IfLuid If...

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Task: NduUpdateProcessStatsForContainerOrVmId

Description

NduUpdateProcessStatsForContainerOrVmId succeeded: CurrentProcNumber:NduUpdateProcessStatsForContainerOrVmId_succeeded_CurrentProcNumber PartitionId:PartitionId Direction:Direction IfLuid:IfLuid IfType:IfType BytesSent:BytesSent BytesRecvd:BytesRecvd.

Message #

NduUpdateProcessStatsForContainerOrVmId succeeded: CurrentProcNumber:%1 PartitionId:%2 Direction:%3 IfLuid:%4 IfType:%5 BytesSent:%6 BytesRecvd:%7

Fields #

Name	Description
`CurrentProcNumber` UInt32
`PartitionId` GUID
`Direction` UInt8	Known values `%%14592` Inbound `%%14593` Outbound `%%14594` Forward `%%14595` Bidirectional
`IfLuid` UInt64
`IfType` UInt32
`BytesSent` UInt64
`BytesRecvd` UInt64

Event ID 2021: OuterProcessId: VirtualIfLuid:IfAlias OuterProcessId:Title IfAlias:VirtualIfLuid.

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Task: NduVpnDebugInfo

Description

OuterProcessId: VirtualIfLuid:IfAlias OuterProcessId:Title IfAlias:VirtualIfLuid.

Message #

%1: VirtualIfLuid:%2 OuterProcessId:%3 IfAlias:%4

Fields #

Name	Description
`Title` UnicodeString
`VirtualIfLuid` UInt64
`OuterProcessId` UInt32	1: VirtualIfLuid.
`IfAlias` UnicodeString

Event ID 2022: Wake count updated IfLuid:IfLuid Flow Id:FlowHandle (0 means interface) WakeCount:WakeCount.

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Task: NduDebugTrace

Description

Wake count updated IfLuid:IfLuid Flow Id:FlowHandle (0 means interface) WakeCount:WakeCount.

Message #

Wake count updated IfLuid:%1 Flow Id:%2 (0 means interface) WakeCount:%3

Fields #

Name	Description
`IfLuid` UInt64
`FlowHandle` UInt64
`WakeCount` UInt32

Event ID 2023

Provider: Microsoft-Windows-Ndu
Channel: Diagnostic
Task: PerInterfaceStats

Fields #

Name	Description
`_ProcNum` UInt32
`_ListIndex` UInt16
`_ListHead` UInt64
`_Entry` UInt64
`_EntryFlink` UInt64
`_EntryBlink` UInt64
`_Flags` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {DF271536-4298-45E1-B0F2-E88F78619C5D}

Defined in ndu.sys, the binary that emits these events.

Observed on:

Win11-26200.6584, sample captured from a live trace, binary version 10.0.26100.5074, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02

Downloads

Microsoft-Windows-Ndu registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)