Microsoft-Windows-PCI

Event	Title	Channel	Sample	Rule
1	Message.	Operational	Y	N
2	Message.	Operational	N	N
3	Message.	Operational	N	N
10	AspmErrataRundown	Diagnostic, Operational	N	N

Event ID 1: Message.

Channel: Operational
Level: Informational
Task: Log

Message #

%6

Fields #

Name	Description
`Category` HexInt64
`Rid` HexInt32
`Secondary` UInt8
`PreciseTime` UInt64
`Qpc` UInt64
`Message` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PCI",
    "event_id": 1,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "time_created": "2026-04-18T03:03:26.4685233+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-PCI"
  },
  "event_data": {
    "Category": "0x22",
    "Qpc": "53286791",
    "Rid": "0x90",
    "PreciseTime": "53061780",
    "Secondary": "255",
    "Message": "[PDO] (0x0000.0x12.0x00): Finish state transition to STARTED"
  }
}

Event ID 2: Message.

Channel: Operational
Task: Log

Message #

%6

Fields #

Name	Description
`Category` HexInt64
`Rid` HexInt32
`Secondary` UInt8
`PreciseTime` UInt64
`Qpc` UInt64
`Message` UnicodeString

Event ID 3: Message.

Channel: Operational
Task: Log

Message #

%6

Fields #

Name	Description
`Category` HexInt64
`Rid` HexInt32
`Secondary` UInt8
`PreciseTime` UInt64
`Qpc` UInt64
`Message` UnicodeString

Event ID 10: AspmErrataRundown

Channel: Diagnostic, Operational
Task: AspmErrataRundown

Provenance

ETW provider GUID 1a9443d4-b099-44d6-8eb1-829b9c2fe290

Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB