detection.wiki

Microsoft-Windows-Proximity-Common

EventTitleChannelSampleRule
5A Proximity device arrival event has occurred with provider: Pointer1.PerformanceNN
10Proximity OOB message is received for incoming message pointer Pointer1.InformationalNN
11Outbound OOB message publishing begins for incoming message pointer Pointer1, …InformationalNN
12Outbound OOB message publishing ends for incoming message pointer Pointer1, AEP …InformationalNN
13Consent UI is to be displayed for incoming message pointer Pointer1, AEP ID …InformationalNN
14Proximity association begins.PerformanceNN
15Proximity association is completed, result HrResult.PerformanceNN
16Proximity session launch event received for app: String.PerformanceNN
17Proximity session launch notification displayed for app: String.PerformanceNN
18Proximity receive shared content event triggered for provider: Pointer1.PerformanceNN
19Proximity receive shared content prompt displayed for provider: Pointer1.PerformanceNN
20Proximity protocol exchange started for app: String.PerformanceNN
21Proximity protocol exchange completed app: String.PerformanceNN
22Proximity socket connection started for app: String.PerformanceNN
23Proximity connected proximity socket of type: Integer4, and handed to app: …PerformanceNN
24Browse PeerId String1 already registered for app: String2.DiagnosticNN
30Proximity receive shared content start showing receive progress UI event …PerformanceNN
31Proximity receive shared content finished showing receive progress UI for …PerformanceNN
40A socket connection is starting.PerformanceNN
41The socket connection completed with transport = TransportType, and hresult = …PerformanceNN

Event ID 5: A Proximity device arrival event has occurred with provider: Pointer1.

#
Channel
Performance
Task
Proximity_DeviceArrivalTrigger
Opcode
Start

Message #

A Proximity device arrival event has occurred with provider: %1

Fields #

NameDescription
Pointer1 Pointer

Event ID 10: Proximity OOB message is received for incoming message pointer Pointer1.

#
Channel
Informational
Task
Proximity_OOBMessageProcessing
Opcode
Start

Message #

Proximity OOB message is received for incoming message pointer %1

Fields #

NameDescription
Pointer1 Pointer

Event ID 11: Outbound OOB message publishing begins for incoming message pointer Pointer1, AEP ID String2, device String3.

#
Channel
Informational
Task
Proximity_OOBMessagePublishing
Opcode
Start

Message #

Outbound OOB message publishing begins for incoming message pointer %1, AEP ID %2, device %3

Fields #

NameDescription
Pointer1 Pointer
String2 UnicodeString
String3 UnicodeString

Event ID 12: Outbound OOB message publishing ends for incoming message pointer Pointer1, AEP ID String2, device String3.

#
Channel
Informational
Task
Proximity_OOBMessagePublishing
Opcode
Stop

Message #

Outbound OOB message publishing ends for incoming message pointer %1, AEP ID %2, device %3

Fields #

NameDescription
Pointer1 Pointer
String2 UnicodeString
String3 UnicodeString

Event ID 13: Consent UI is to be displayed for incoming message pointer Pointer1, AEP ID String2, device String3.

#
Channel
Informational
Task
Proximity_OOBMessageProcessing
Opcode
Stop

Message #

Consent UI is to be displayed for incoming message pointer %1, AEP ID %2, device %3

Fields #

NameDescription
Pointer1 Pointer
String2 UnicodeString
String3 UnicodeString

Event ID 14: Proximity association begins.

#
Channel
Performance
Task
Proximity_DeviceAssociation
Opcode
Start

Description

Proximity association begins. User response is HrResult. Device category DeviceCategory.

Message #

Proximity association begins. User response is %1. Device category %2

Fields #

NameDescription
HrResult UInt32
DeviceCategory UnicodeString

Event ID 15: Proximity association is completed, result HrResult.

#
Channel
Performance
Task
Proximity_DeviceAssociation
Opcode
Stop

Description

Proximity association is completed, result HrResult. Device category DeviceCategory.

Message #

Proximity association is completed, result %1. Device category %2

Fields #

NameDescription
HrResult UInt32
DeviceCategory UnicodeString

Event ID 16: Proximity session launch event received for app: String.

#
Channel
Performance
Task
Proximity_SessionAppLaunch
Opcode
Start

Message #

Proximity session launch event received for app: %1

Fields #

NameDescription
String UnicodeString

Event ID 17: Proximity session launch notification displayed for app: String.

#
Channel
Performance
Task
Proximity_SessionAppLaunch
Opcode
Stop

Message #

Proximity session launch notification displayed for app: %1

Fields #

NameDescription
String UnicodeString

Event ID 18: Proximity receive shared content event triggered for provider: Pointer1.

#
Channel
Performance
Task
Proximity_ReceiveSharedContent
Opcode
Start

Message #

Proximity receive shared content event triggered for provider: %1

Fields #

NameDescription
Pointer1 Pointer

Event ID 19: Proximity receive shared content prompt displayed for provider: Pointer1.

#
Channel
Performance
Task
Proximity_ReceiveSharedContent
Opcode
Stop

Message #

Proximity receive shared content prompt displayed for provider: %1

Fields #

NameDescription
Pointer1 Pointer

Event ID 20: Proximity protocol exchange started for app: String.

#
Channel
Performance
Task
Proximity_SessionProtocol
Opcode
Start

Message #

Proximity protocol exchange started for app: %1

Fields #

NameDescription
String UnicodeString

Event ID 21: Proximity protocol exchange completed app: String.

#
Channel
Performance
Task
Proximity_SessionProtocol
Opcode
Stop

Message #

Proximity protocol exchange completed app: %1

Fields #

NameDescription
String UnicodeString

Event ID 22: Proximity socket connection started for app: String.

#
Channel
Performance
Task
Proximity_SessionConnect
Opcode
Start

Message #

Proximity socket connection started for app: %1

Fields #

NameDescription
String UnicodeString

Event ID 23: Proximity connected proximity socket of type: Integer4, and handed to app: String.

#
Channel
Performance
Task
Proximity_SessionConnect
Opcode
Stop

Message #

Proximity connected proximity socket of type: %1, and handed to app: %2

Fields #

NameDescription
Integer4 UInt32
String UnicodeString

Event ID 24: Browse PeerId String1 already registered for app: String2.

#
Channel
Diagnostic

Message #

Browse PeerId %1 already registered for app: %2

Fields #

NameDescription
String1 UnicodeString
String2 UnicodeString

Event ID 30: Proximity receive shared content start showing receive progress UI event triggered for provider: Pointer1.

#
Channel
Performance
Task
Proximity_ReceiveSharedContent
Opcode
Start

Message #

Proximity receive shared content start showing receive progress UI event triggered for provider: %1

Fields #

NameDescription
Pointer1 Pointer

Event ID 31: Proximity receive shared content finished showing receive progress UI for provider: Pointer1.

#
Channel
Performance
Task
Proximity_ReceiveSharedContent
Opcode
Stop

Message #

Proximity receive shared content finished showing receive progress UI for provider: %1

Fields #

NameDescription
Pointer1 Pointer

Event ID 40: A socket connection is starting.

#
Channel
Performance
Task
Proximity_SocketConnect
Opcode
Start

Event ID 41: The socket connection completed with transport = TransportType, and hresult = HrConnectResult.

#
Channel
Performance
Task
Proximity_SocketConnect
Opcode
Stop

Message #

The socket connection completed with transport = %1, and hresult = %2

Fields #

NameDescription
TransportType UInt32
HrConnectResult UInt32

Provenance

ETW provider GUID 28058203-d394-4afc-b2a6-2f9155a3bb95

Defined in ProximityCommon.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB