Microsoft-Windows-Networking-Correlation
8 events across 1 channel
| Event | Title | Channel | Sample |
|---|---|---|---|
| 3001 | Dummy event for standard level enumeration | Diagnostic | N |
| 3002 | Dummy event for standard level enumeration | Diagnostic | N |
| 3003 | Dummy event for standard level enumeration | Diagnostic | N |
| 3004 | Dummy event for standard level enumeration | Diagnostic | N |
| 3005 | Dummy event for standard level enumeration | Diagnostic | N |
| 60001 | Source Provider: SourceProvider Context: Context. | Diagnostic | Y |
| 60002 | Source Provider: SourceProvider Context: Context. | Diagnostic | Y |
| 60003 | Source Provider: SourceProvider Context: Context. | Diagnostic | Y |
Event ID 3001: Dummy event for standard level enumeration
#Description
Dummy event for standard level enumeration.
Message #
Event ID 3002: Dummy event for standard level enumeration
#Description
Dummy event for standard level enumeration.
Message #
Event ID 3003: Dummy event for standard level enumeration
#Description
Dummy event for standard level enumeration.
Message #
Event ID 3004: Dummy event for standard level enumeration
#Description
Dummy event for standard level enumeration.
Message #
Event ID 3005: Dummy event for standard level enumeration
#Description
Dummy event for standard level enumeration.
Message #
Event ID 60001: Source Provider: SourceProvider Context: Context.
#Description
Source Provider: SourceProvider Context: Context.
Message #
Fields #
| Name | Description |
|---|---|
SourceProvider GUID | |
Context UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Networking-Correlation",
"guid": "{83ed54f0-4d48-4e45-b16e-726ffd1fa4af}",
"event_source_name": "",
"event_id": "60001",
"version": "0",
"level": "1",
"task": "0",
"opcode": "1",
"keywords": 9223372036854775811,
"time_created": "2026-03-15T04:33:23.259134200+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{ba28d8a0-fac6-4470-a0d3-5a9342b1e9c9}"
},
"execution": {
"process_id": "4020",
"thread_id": "6644"
},
"channel": "Microsoft-Windows-Networking-Correlation/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"SourceProvider": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
"Context": " 0"
},
"message": ""
}
Event ID 60002: Source Provider: SourceProvider Context: Context.
#Description
Source Provider: SourceProvider Context: Context.
Message #
Fields #
| Name | Description |
|---|---|
SourceProvider GUID | |
Context UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Networking-Correlation",
"guid": "{83ed54f0-4d48-4e45-b16e-726ffd1fa4af}",
"event_source_name": "",
"event_id": "60002",
"version": "0",
"level": "1",
"task": "0",
"opcode": "2",
"keywords": 9223372036854775813,
"time_created": "2026-03-15T04:33:24.896918000+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{01ef3000-d780-ffff-0000-000000000000}"
},
"execution": {
"process_id": "0",
"thread_id": "0"
},
"channel": "Microsoft-Windows-Networking-Correlation/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"SourceProvider": "{e53c6823-7bb8-44bb-90dc-3f86090d48a6}",
"Context": " 2"
},
"message": ""
}
Event ID 60003: Source Provider: SourceProvider Context: Context.
#Description
Source Provider: SourceProvider Context: Context.
Message #
Fields #
| Name | Description |
|---|---|
SourceProvider GUID | |
Context UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Networking-Correlation",
"guid": "{83ed54f0-4d48-4e45-b16e-726ffd1fa4af}",
"event_source_name": "",
"event_id": "60003",
"version": "0",
"level": "1",
"task": "0",
"opcode": "9",
"keywords": 9223372036854775809,
"time_created": "2026-03-15T04:33:21.215528500+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{9556dc99-1c74-0fb4-cfe6-0100ac5b0000}",
"RelatedActivityID": "{7f29c7b7-c6e5-45f3-b006-ac5f75a40973}"
},
"execution": {
"process_id": "4020",
"thread_id": "2900"
},
"channel": "Microsoft-Windows-Networking-Correlation/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"SourceProvider": "{6ad52b32-d609-4be9-ae07-ce8dae937e39}",
"Context": " 0"
},
"message": ""
}
Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID {83ED54F0-4D48-4E45-B16E-726FFD1FA4AF}
Defined in nettrace.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.1, captured 2026-06-02
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4484, captured 2026-06-02