Microsoft-Windows-NetworkSecurity

Event	Title	Channel	Sample	Rule
801	SA Context SaContextID was created.	Debug	N	N
802	SA Context SaContextID: Result=Result.	Debug	N	N
803	SA Context 5nProtocol:\nLocal Address: SaContextID:LocalMask\nRemote Address: …	Debug	N	N
804	SA Context SaContextID was deleted.	Debug	N	N
805	SA Context SaContextID: SPI=SPI.	Debug	N	N
806	----- BEGIN BFE_SA_CONTEXT processing -----	Debug	N	N
807	----- END BFE_SA_CONTEXT processing -----	Debug	N	N
808	----- BFE SA CONTEXT ID: (SaContextID) -----.	Debug	N	N

Event ID 801: SA Context SaContextID was created.

SA Context %1 was created

Name	Description
`SaContextID` UInt64
`Reason` UInt32

SA Context %1: Result=%2

Name	Description
`SaContextID` UInt64
`Result` UInt32

SA Context %1:\nLocal Address: %2:%4\nRemote Address: %3:%5\nProtocol: %6

Name	Description
`SaContextID` UInt64
`LocalAddr` UnicodeString
`LocalMask` UnicodeString
`LocalPort` UInt16
`RemoteAddress` UnicodeString
`RemoteMask` UnicodeString
`RemotePort` UInt16
`IPProtocol` UInt8
`LocalTunnelEndpt` UnicodeString
`RemoteTunnelEndpt` UnicodeString

SA Context %1 was deleted

Name	Description
`SaContextID` UInt64

SA Context %1: SPI=%2

Name	Description
`SaContextID` UInt64
`SPI` UInt32

----- BFE SA CONTEXT ID: (%1) -----

Name	Description
`SaContextID` UInt64

ETW provider GUID 7b702970-90bc-4584-8b20-c0799086ee5a

Defined in fwpuclnt.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3328, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.3915, captured 2026-06-02 — Manifest XML pack, 2.0 MB