Microsoft-Windows-NvmeDisk

20 events across 4 channels

Event	Title	Channel	Sample
200	Request servicing time taken by device.	Analytic	N
201	Dispatching a read request.	Diagnose	N
202	Dispatching a write request.	Diagnose	N
203	Dispatching a read request.	Diagnose	N
204	Dispatching a write request.	Diagnose	N
205	Completing a NVM command request.	Diagnose	N
206	Retrying an NVM command request.	Diagnose	N
207	Dispatching an IOCTL.	Diagnose	N
208	Completing a non-read/write/Admin Command request.	Diagnose	N
209	Dispatching a PnP request.	Diagnose	N
210	Completing a PnP request.	Diagnose	N
211	Completing a PnP enumeration request.	Diagnose	N
212	Dispatching a PassThrough request.	Diagnose	N
213	NVM command request.	Diagnose	N
214	NVM command request completion.	Diagnose	N
215	The driver changed the removal policy of device number DeviceNumber to	Operational	N
215	The driver changed the removal policy of device number DeviceNumber to …	Diagnose	N
500	Completing a NVM command request with error.	Operational	N
501	The driver detected that the device DeviceGUID has its write cache enabled.	Operational	N
502	The driver disabled the write cache on device DeviceGUID.	Operational	N

Event ID 200: Request servicing time taken by device.

Provider: Microsoft-Windows-NvmeDisk
Channel: Analytic
Task: Class

Description

Request servicing time taken by device.

Message #

Request servicing time taken by device.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`RequestDuration_100ns` UInt64
`Irp` Pointer
`CommandType` UnicodeString
`CommandTag` UInt32
`NTStatus` HexInt32	NTSTATUS reference
`Command` HexInt32
`CDW10` HexInt32
`CDW11` HexInt32
`CDW12` HexInt32
`CDW13` HexInt32
`CDW14` HexInt32
`CDW15` HexInt32

Event ID 201: Dispatching a read request.

Provider: Microsoft-Windows-NvmeDisk
Channel: Diagnose
Task: Class
Opcode: Dispatchingofrequest.

Description

Dispatching a read request.

Message #

Dispatching a read request.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`Irp` Pointer
`Command` UInt8
`LengthOfTransfer` UInt64
`LBA` HexInt64

Event ID 202: Dispatching a write request.

Provider: Microsoft-Windows-NvmeDisk
Channel: Diagnose
Task: Class
Opcode: Dispatchingofrequest.

Description

Dispatching a write request.

Message #

Dispatching a write request.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`Irp` Pointer
`Command` UInt8
`LengthOfTransfer` UInt64
`LBA` HexInt64

Event ID 203: Dispatching a read request.

Provider: Microsoft-Windows-NvmeDisk
Channel: Diagnose
Task: Class
Opcode: Dispatchingofrequest.

Description

Dispatching a read request.

Message #

Dispatching a read request.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`Irp` Pointer
`Command` UInt8
`LengthOfTransfer` UInt64
`LBA` HexInt64

Event ID 204: Dispatching a write request.

Provider: Microsoft-Windows-NvmeDisk
Channel: Diagnose
Task: Class
Opcode: Dispatchingofrequest.

Description

Dispatching a write request.

Message #

Dispatching a write request.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`Irp` Pointer
`Command` UInt8
`LengthOfTransfer` UInt64
`LBA` HexInt64

Event ID 205: Completing a NVM command request.

Provider: Microsoft-Windows-NvmeDisk
Channel: Diagnose
Task: Class
Opcode: Completionofrequest.

Description

Completing a NVM command request.

Message #

Completing a NVM command request.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`Irp` Pointer
`NTStatus` HexInt32	NTSTATUS reference
`CommandTag` UInt32
`OPC` HexInt32
`CID` UInt32
`SQID` UInt32
`DW0` UInt32
`DW1` UInt32
`SCT` HexInt32
`SC` HexInt32
`DNR` UInt8

Event ID 206: Retrying an NVM command request.

Provider: Microsoft-Windows-NvmeDisk
Channel: Diagnose
Task: Class
Opcode: Retryhandling.

Description

Retrying an NVM command request.

Message #

Retrying an NVM command request.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`Irp` Pointer
`CurrentRetryCount` UInt32
`SCT` UInt8
`SC` UInt8

Event ID 207: Dispatching an IOCTL.

Provider: Microsoft-Windows-NvmeDisk
Channel: Diagnose
Task: Class
Opcode: Dispatchingofrequest.

Description

Dispatching an IOCTL.

Message #

Dispatching an IOCTL.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`Irp` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Parameter` HexInt32

Event ID 208: Completing a non-read/write/Admin Command request.

Provider: Microsoft-Windows-NvmeDisk
Channel: Diagnose
Task: Class
Opcode: Completionofrequest.

Description

Completing a non-read/write/Admin Command request.

Message #

Completing a non-read/write/Admin Command request.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`Irp` Pointer
`Status` HexInt32	NTSTATUS reference

Event ID 209: Dispatching a PnP request.

Provider: Microsoft-Windows-NvmeDisk
Channel: Diagnose
Task: Class
Opcode: Dispatchingofrequest.

Description

Dispatching a PnP request.

Message #

Dispatching a PnP request.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`Irp` Pointer
`MinorFunction` HexInt32
`Type` HexInt32
`DeviceObject` Pointer

Event ID 210: Completing a PnP request.

Provider: Microsoft-Windows-NvmeDisk
Channel: Diagnose
Task: Class
Opcode: Completionofrequest.

Description

Completing a PnP request.

Message #

Completing a PnP request.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`Irp` Pointer
`Status` HexInt32	NTSTATUS reference

Event ID 211: Completing a PnP enumeration request.

Provider: Microsoft-Windows-NvmeDisk
Channel: Diagnose
Task: Class
Opcode: Completionofrequest.

Description

Completing a PnP enumeration request.

Message #

Completing a PnP enumeration request.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`Irp` Pointer
`NumberOfChildren` UInt32
`Status` HexInt32	NTSTATUS reference

Event ID 212: Dispatching a PassThrough request.

Provider: Microsoft-Windows-NvmeDisk
Channel: Diagnose
Task: Class
Opcode: Dispatchingofrequest.

Description

Dispatching a PassThrough request.

Message #

Dispatching a PassThrough request.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`Irp` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Parameter` HexInt32

Event ID 213: NVM command request.

Provider: Microsoft-Windows-NvmeDisk
Channel: Diagnose
Task: Class
Opcode: Dispatchingofrequest.

Description

NVM command request.

Message #

NVM command request.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`Irp` Pointer
`CommandTag` UInt32
`OPC` HexInt32
`CID` UInt32
`NSID` UInt32
`PRP1` HexInt64
`PRP2` HexInt64
`CDW10` HexInt32
`CDW11` HexInt32
`CDW12` HexInt32
`CDW13` HexInt32
`CDW14` HexInt32
`CDW15` HexInt32

Event ID 214: NVM command request completion.

Provider: Microsoft-Windows-NvmeDisk
Channel: Diagnose
Task: Class
Opcode: Completionofrequest.

Description

NVM command request completion.

Message #

NVM command request completion.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`Irp` Pointer
`NTStatus` HexInt32	NTSTATUS reference
`CommandTag` UInt32
`OPC` HexInt32
`CID` UInt32
`SQID` UInt32
`DW0` UInt32
`DW1` UInt32
`SCT` HexInt32
`SC` HexInt32
`DNR` UInt8

Event ID 215: The driver changed the removal policy of device number DeviceNumber to

Provider: Microsoft-Windows-NvmeDisk
Channel: Operational
Task: Class
Opcode: Dispatchingofrequest.

Description

The driver changed the removal policy of device number to .

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`RemovalPolicy` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 215: The driver changed the removal policy of device number DeviceNumber to RemovalPolicy.

Provider: Microsoft-Windows-NvmeDisk
Channel: Diagnose
Task: Class
Opcode: Dispatchingofrequest.

Description

The driver changed the removal policy of device number DeviceNumber to RemovalPolicy.

Message #

The driver changed the removal policy of device number %2 to %6.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`RemovalPolicy` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 500: Completing a NVM command request with error.

Provider: Microsoft-Windows-NvmeDisk
Channel: Operational
Task: Class
Opcode: Completionofrequest.

Description

Completing a NVM command request with error.

Message #

Completing a NVM command request with error.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`Irp` Pointer
`NTStatus` HexInt32	NTSTATUS reference
`CommandTag` UInt32
`OPC` HexInt32
`CID` UInt32
`SQID` UInt32
`DW0` UInt32
`DW1` UInt32
`SCT` HexInt32
`SC` HexInt32
`DNR` UInt8

Event ID 501: The driver detected that the device DeviceGUID has its write cache enabled.

Provider: Microsoft-Windows-NvmeDisk
Channel: Operational
Task: Class
Opcode: Dispatchingofrequest.

Description

The driver detected that the device DeviceGUID has its write cache enabled.

Message #

The driver detected that the device %1 has its write cache enabled.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`NamespaceID` UInt32
`VwcEnabled` Boolean
`Status` HexInt32	NTSTATUS reference

Event ID 502: The driver disabled the write cache on device DeviceGUID.

Provider: Microsoft-Windows-NvmeDisk
Channel: Operational
Task: Class
Opcode: Dispatchingofrequest.

Description

The driver disabled the write cache on device DeviceGUID.

Message #

The driver disabled the write cache on device %1.

Fields #

Name	Description
`DeviceGUID` GUID
`DeviceNumber` UInt32
`Model` AnsiString
`FirmwareVersion` AnsiString
`SerialNumber` AnsiString
`NamespaceID` UInt32
`VwcEnabled` Boolean
`Status` HexInt32	NTSTATUS reference

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 9799276c-fb04-47e8-845e-36946045c218

Defined in nvmedisk.sys, the binary that emits these events.

Observed on:

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4484, captured 2026-06-02

Downloads

Microsoft-Windows-NvmeDisk registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)