Microsoft-Windows-PerfNet

36 events across 2 channels

Event	Title	Channel	Sample
1000	Unable to open the Network Services performance object.	Application	N
1001	Unable to collect Network Services performance data.	Application	N
2000	Unable to collect Browser performance data because the NetApi32.	Application	N
2001	Unable to collect Browser performance data because the Query function was not …	Application	N
2002	Unable to open the Redirector service performance object.	Application	N
2003	Unable to read performance data for the Redirector service.	Application	N
2004	Unable to open the Server service performance object.	Application	N
2005	Unable to read performance data for the Server service.	Application	N
2006	Unable to read Server Queue performance data from the Server service.	Application	N
2007	Unable to allocate memory for TDI Statistics block.	Application	N
3000	Entered the OpenNbtPerformanceData routine.	Operational	N
3099	The OpenNbtPerformanceData routine successfully completed.	Operational	N
3100	Entered the CollectNbtPerformanceData routine.	Operational	N
3101	Unable to read IO control information from an NBT device.	Application	N
3102	Successfully read the NBT device IO Control information.	Operational	N
3103	The data buffer passed to the collection routine was too small to receive the …	Operational	N
3199	The CollectNbtPerformanceData routine successfully completed.	Operational	N
3200	Entered the CloseNbtPerformanceData routine.	Operational	N
4000	Entered the OpenTcpIpPerformanceData routine.	Operational	N
4001	NBT Open failed.	Operational	N
4002	NBT Open succeeded.	Operational	N
4010	Unable to get the local computer name.	Application	N
4099	The OpenTcpIpPerformanceData routine successfully completed.	Operational	N
4100	Entered the CollectTcpIpPerformanceData routine.	Operational	N
4105	The CollectNbtPerformanceData routine returned an error.	Operational	N
4106	The OpenTcpIpPerformanceData routine did not establish a SNMP Mgr Session.	Operational	N
4108	The SnmpMgrRequest call requesting the TCP, IP, UDP and Interface Counters …	Operational	N
4110	The SnmpMgrRequest call requesting ICMP Counters returned an error.	Operational	N
4111	Processing NetInterface entries.	Operational	N
4112	The buffer is not large enough to store the Network Interface data.	Operational	N
4113	The SnmpGet (GETNEXT) request returned an error while processing the Net …	Operational	N
4114	Copying data from network requests to the Performance Monitor buffer.	Operational	N
4116	The buffer is not large enough to store the Network Protocol (IP, ICMP, TCP & …	Operational	N
4121	SNMP returned a NULL buffer in response to a request for network performance …	Application	N
4199	The CollectTcpIpPerformanceData routine successfully completed.	Operational	N
4200	Entered the CloseTcpIpPerformanceData routine.	Operational	N

Event ID 1000: Unable to open the Network Services performance object.

Provider: Microsoft-Windows-PerfNet
Channel: Application

Description

Unable to open the Network Services performance object. Error: Win32Error.

Message #

Unable to open the Network Services performance object. Error: %1

Fields #

Name	Description
`Win32Error` UInt32

Event ID 1001: Unable to collect Network Services performance data.

Provider: Microsoft-Windows-PerfNet
Channel: Application

Description

Unable to collect Network Services performance data. The DLL failed to load because it cannot successfully communicate with network service devices.

Message #

Unable to collect Network Services performance data. The DLL failed to load because it cannot successfully communicate with network service devices.

Event ID 2000: Unable to collect Browser performance data because the NetApi32.

Provider: Microsoft-Windows-PerfNet
Channel: Application

Description

Unable to collect Browser performance data because the NetApi32.DLL failed to load. Error: Win32Error.

Message #

Unable to collect Browser performance data because the NetApi32.DLL failed to load. Error: %1

Fields #

Name	Description
`Win32Error` UInt32

Event ID 2001: Unable to collect Browser performance data because the Query function was not found in the NetApi32.

Provider: Microsoft-Windows-PerfNet
Channel: Application

Description

Unable to collect Browser performance data because the Query function was not found in the NetApi32.DLL. Error: NTSTATUS.

Message #

Unable to collect Browser performance data because the Query function was not found in the NetApi32.DLL. Error: %1

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2002: Unable to open the Redirector service performance object.

Provider: Microsoft-Windows-PerfNet
Channel: Application

Description

Unable to open the Redirector service performance object. Error: NTSTATUS.

Message #

Unable to open the Redirector service performance object. Error: %1

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2003: Unable to read performance data for the Redirector service.

Provider: Microsoft-Windows-PerfNet
Channel: Application

Description

Unable to read performance data for the Redirector service. Error: NTSTATUS.

Message #

Unable to read performance data for the Redirector service. Error: %1

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2004: Unable to open the Server service performance object.

Provider: Microsoft-Windows-PerfNet
Channel: Application

Description

Unable to open the Server service performance object. Error: NTSTATUS.

Message #

Unable to open the Server service performance object. Error: %1

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2005: Unable to read performance data for the Server service.

Provider: Microsoft-Windows-PerfNet
Channel: Application

Description

Unable to read performance data for the Server service. Error: NTSTATUS.

Message #

Unable to read performance data for the Server service. Error: %1

Fields #

Name	Description
`NTSTATUS` UInt32
`IOCompletionNTSTATUS` UInt32

Event ID 2006: Unable to read Server Queue performance data from the Server service.

Provider: Microsoft-Windows-PerfNet
Channel: Application

Description

Unable to read Server Queue performance data from the Server service. Error: NTSTATUS.

Message #

Unable to read Server Queue performance data from the Server service. Error: %1

Fields #

Name	Description
`NTSTATUS` UInt32
`IOCompletionNTSTATUS` UInt32

Event ID 2007: Unable to allocate memory for TDI Statistics block.

Provider: Microsoft-Windows-PerfNet
Channel: Application

Description

Unable to allocate memory for TDI Statistics block. Close one or more applications and retry.

Message #

Unable to allocate memory for TDI Statistics block. Close one or more applications and retry.

Event ID 3000: Entered the OpenNbtPerformanceData routine.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

Entered the OpenNbtPerformanceData routine.

Message #

Entered the OpenNbtPerformanceData routine.

Event ID 3099: The OpenNbtPerformanceData routine successfully completed.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

The OpenNbtPerformanceData routine successfully completed.

Message #

The OpenNbtPerformanceData routine successfully completed.

Event ID 3100: Entered the CollectNbtPerformanceData routine.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

Entered the CollectNbtPerformanceData routine.

Message #

Entered the CollectNbtPerformanceData routine.

Fields #

Name	Description
`ValueName` UnicodeString

Event ID 3101: Unable to read IO control information from an NBT device.

Provider: Microsoft-Windows-PerfNet
Channel: Application

Description

Unable to read IO control information from an NBT device. A network device using the NBT protocol could not be queried.

Message #

Unable to read IO control information from an NBT device. A network device using the NBT protocol could not be queried.

Event ID 3102: Successfully read the NBT device IO Control information.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

Successfully read the NBT device IO Control information.

Message #

Successfully read the NBT device IO Control information.

Event ID 3103: The data buffer passed to the collection routine was too small to receive the data from the NBT device.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

The data buffer passed to the collection routine was too small to receive the data from the NBT device. No data was returned to the caller. The bytes available and the bytes required are in the message data.

Message #

The data buffer passed to the collection routine was too small to receive the data from the NBT device. No data was returned to the caller. The bytes available and the bytes required are in the message data.

Fields #

Name	Description
`Available` UInt32
`Required` UInt32

Event ID 3199: The CollectNbtPerformanceData routine successfully completed.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

The CollectNbtPerformanceData routine successfully completed.

Message #

The CollectNbtPerformanceData routine successfully completed.

Event ID 3200: Entered the CloseNbtPerformanceData routine.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

Entered the CloseNbtPerformanceData routine.

Message #

Entered the CloseNbtPerformanceData routine.

Event ID 4000: Entered the OpenTcpIpPerformanceData routine.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

Entered the OpenTcpIpPerformanceData routine.

Message #

Entered the OpenTcpIpPerformanceData routine.

Event ID 4001: NBT Open failed.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

NBT Open failed. See NBT error message.

Message #

NBT Open failed. See NBT error message.

Event ID 4002: NBT Open succeeded.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

NBT Open succeeded.

Message #

NBT Open succeeded.

Event ID 4010: Unable to get the local computer name.

Provider: Microsoft-Windows-PerfNet
Channel: Application

Description

Unable to get the local computer name. The data in the data section contains the error code.

Message #

Unable to get the local computer name. The data in the data section contains the error code.

Fields #

Name	Description
`Error` UInt32

Event ID 4099: The OpenTcpIpPerformanceData routine successfully completed.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

The OpenTcpIpPerformanceData routine successfully completed.

Message #

The OpenTcpIpPerformanceData routine successfully completed.

Event ID 4100: Entered the CollectTcpIpPerformanceData routine.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

Entered the CollectTcpIpPerformanceData routine.

Message #

Entered the CollectTcpIpPerformanceData routine.

Fields #

Name	Description
`ValueName` UnicodeString

Event ID 4105: The CollectNbtPerformanceData routine returned an error.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

The CollectNbtPerformanceData routine returned an error. The error status is in the data section.

Message #

The CollectNbtPerformanceData routine returned an error. The error status is in the data section.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 4106: The OpenTcpIpPerformanceData routine did not establish a SNMP Mgr Session.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

The OpenTcpIpPerformanceData routine did not establish a SNMP Mgr Session.

Message #

The OpenTcpIpPerformanceData routine did not establish a SNMP Mgr Session.

Event ID 4108: The SnmpMgrRequest call requesting the TCP, IP, UDP and Interface Counters returned an error.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

The SnmpMgrRequest call requesting the TCP, IP, UDP and Interface Counters returned an error. The ErrorStatus and ErrorIndex values are shown in Data.

Message #

The SnmpMgrRequest call requesting the TCP, IP, UDP and Interface Counters returned an error. The ErrorStatus and ErrorIndex values are shown in Data.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 4110: The SnmpMgrRequest call requesting ICMP Counters returned an error.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

The SnmpMgrRequest call requesting ICMP Counters returned an error. The ErrorStatus and ErrorIndex values are shown in Data.

Message #

The SnmpMgrRequest call requesting ICMP Counters returned an error. The ErrorStatus and ErrorIndex values are shown in Data.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 4111: Processing NetInterface entries.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

Processing NetInterface entries.

Message #

Processing NetInterface entries.

Event ID 4112: The buffer is not large enough to store the Network Interface data.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

The buffer is not large enough to store the Network Interface data. The returned data contains the available and required buffer size.

Message #

The buffer is not large enough to store the Network Interface data. The returned data contains the available and required buffer size.

Fields #

Name	Description
`Available` UInt32
`Required` UInt32

Event ID 4113: The SnmpGet (GETNEXT) request returned an error while processing the Net Interface instances.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

The SnmpGet (GETNEXT) request returned an error while processing the Net Interface instances. The ErrorStatus and ErrorIndex are shown in Data.

Message #

The SnmpGet (GETNEXT) request returned an error while processing the Net Interface instances. The ErrorStatus and ErrorIndex are shown in Data.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 4114: Copying data from network requests to the Performance Monitor buffer.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

Copying data from network requests to the Performance Monitor buffer.

Message #

Copying data from network requests to the Performance Monitor buffer.

Event ID 4116: The buffer is not large enough to store the Network Protocol (IP, ICMP, TCP & UDP) data.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

The buffer is not large enough to store the Network Protocol (IP, ICMP, TCP & UDP) data. The returned data contains the available and required buffer size.

Message #

The buffer is not large enough to store the Network Protocol (IP, ICMP, TCP & UDP) data. The returned data contains the available and required buffer size.

Fields #

Name	Description
`Available` UInt32
`Required` UInt32

Event ID 4121: SNMP returned a NULL buffer in response to a request for network performance information.

Provider: Microsoft-Windows-PerfNet
Channel: Application

Description

SNMP returned a NULL buffer in response to a request for network performance information. This error may be caused by a problem with the SNMP service.

Message #

SNMP returned a NULL buffer in response to a request for network performance information. This error may be caused by a problem with the SNMP service.

Event ID 4199: The CollectTcpIpPerformanceData routine successfully completed.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

The CollectTcpIpPerformanceData routine successfully completed.

Message #

The CollectTcpIpPerformanceData routine successfully completed.

Event ID 4200: Entered the CloseTcpIpPerformanceData routine.

Provider: Microsoft-Windows-PerfNet
Channel: Operational

Description

Entered the CloseTcpIpPerformanceData routine.

Message #

Entered the CloseTcpIpPerformanceData routine.

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID cab2b8a5-49b9-4eec-b1b0-fac21da05a3b

Defined in perfnet.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)