Microsoft-Windows-Network-DataUsage
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1001 | CreateHelperStart | Analytic | N | N |
| 1002 | CreateHelperStop | Analytic | N | N |
| 1003 | SetVisibilityStart | Analytic | N | N |
| 1004 | SetVisibilityStop | Analytic | N | N |
| 1005 | ResetCountStart | Analytic | N | N |
| 1006 | ResetCountStop | Analytic | N | N |
| 1007 | GetDisplayTextStart | Analytic | N | N |
| 1008 | GetDisplayTextStop | Analytic | N | N |
| 1009 | SetListenerStart | Analytic | N | N |
| 1010 | SetListenerStop | Analytic | N | N |
| 1011 | ProcessUpdateStart | Analytic | N | N |
| 1012 | ProcessUpdateStop | Analytic | N | N |
| 1013 | CallSystemMonitorStart | Analytic | N | N |
| 1014 | CallSystemMonitorStop | Analytic | N | N |
Event ID 1001: CreateHelperStart
#Event ID 1002: CreateHelperStop
#Event ID 1003: SetVisibilityStart
#Event ID 1004: SetVisibilityStop
#Event ID 1005: ResetCountStart
#Event ID 1006: ResetCountStop
#Event ID 1007: GetDisplayTextStart
#Event ID 1008: GetDisplayTextStop
#Event ID 1009: SetListenerStart
#Event ID 1010: SetListenerStop
#Event ID 1011: ProcessUpdateStart
#Event ID 1012: ProcessUpdateStop
#Event ID 1013: CallSystemMonitorStart
#Event ID 1014: CallSystemMonitorStop
#Provenance
ETW provider GUID 5c1c9ab3-8689-4e41-90fa-85858306d7b7
Defined in datusage.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB