Microsoft-Windows-Sdbus

27 events across 3 channels

Event	Title	Channel	Sample
100	Interrupt detected in ISR.	Analytic	N
101	Entering callback routine.	Analytic	N
102	Exiting callback routine.	Analytic	N
103	Retuning Sequence detected.	Analytic	N
104	Error in bus transfer.	Debug	N
105	Hpi IO detected.	Analytic	N
106	P-State change requested.	Analytic	N
107	P-State change requested.	Analytic	N
108	Command issued.	Analytic	N
109	Command completed.	Analytic	N
110	Hpi CMD sent to the hardware.	Analytic	N
111	Hpi CMD was accepted by the hardware.	Analytic	N
112	Hpi CMD worker started.	Analytic	N
113	Hpi CMD worker exited.	Analytic	N
114	P-State change requested.	Analytic	N
115	SdbusWorkerDpcEnter: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp …	Analytic	N
116	SdbusWorkerDpcExit: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp …	Analytic	N
117	SdbusRequestStart: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Cmd: …	Analytic	N
118	SdbusRequestComplete: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp …	Analytic	N
119	Scheduled callback routine.	Analytic	N
120	Interrupt DPC scheduled.	Analytic	N
121	Interrupt DPC entered.	Analytic	N
122	Interrupt DPC exited.	Analytic	N
123	SdbusRequestStartV2: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp …	Analytic	N
123	Event ID 123	Operational	N
124	SdbusRequestCompleteV2: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp …	Analytic	N
124	Event ID 124	Operational	N

Event ID 100: Interrupt detected in ISR.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: Interrupt

Description

Interrupt detected in ISR.

Message #

Interrupt detected in ISR.
SD Host Physical Address: %1
Events (masked): %2

Fields #

Name	Description
`SDHostPhysicalAddress` HexInt64
`EventMask` HexInt32

Event ID 101: Entering callback routine.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: CallbackRoutine
Opcode: Start

Description

Entering callback routine.

Message #

Entering callback routine.
SD Host Physical Address: %1

Fields #

Name	Description
`SDHostPhysicalAddress` HexInt64

Event ID 102: Exiting callback routine.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: CallbackRoutine
Opcode: Stop

Description

Exiting callback routine.

Message #

Exiting callback routine.
SD Host Physical Address: %1

Fields #

Name	Description
`SDHostPhysicalAddress` HexInt64

Event ID 103: Retuning Sequence detected.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: Retune

Description

Retuning Sequence detected.

Message #

Retuning Sequence detected.
SD Host Physical Address: %1
Retuning Count: %2

Fields #

Name	Description
`SDHostPhysicalAddress` HexInt64
`RetuneCount` UInt64

Event ID 104: Error in bus transfer.

Provider: Microsoft-Windows-Sdbus
Channel: Debug
Task: Error

Description

Error in bus transfer.

Message #

Error in bus transfer.
SD Host Physical Address: %1
Error Code: %2
Error Count: %3

Fields #

Name	Description
`SDHostPhysicalAddress` HexInt64
`ErrorCode` HexInt32
`ErrorCount` UInt32

Event ID 105: Hpi IO detected.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: HPIIO

Description

Hpi IO detected.

Message #

Hpi IO detected.
SD Host Physical Address: %1
Hpi Count: %2

Fields #

Name	Description
`SDHostPhysicalAddress` HexInt64
`HpiIoCount` UInt64

Event ID 106: P-State change requested.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: P_StateRequest

Description

P-State change requested.

Message #

P-State change requested.
PoFx Device Handle: %1
P-State Requested: %2
P-State Request Count: %3

Fields #

Name	Description
`PoFxDeviceHandle` HexInt64
`PStateRequested` UInt32
`PStateRequestCount` UInt64

Event ID 107: P-State change requested.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: P_StateCompletion

Description

P-State change requested.

Message #

P-State change requested.
PoFx Device Handle: %1
P-State Completed: %2
P-State Completion Count: %3

Fields #

Name	Description
`PoFxDeviceHandle` HexInt64
`PStateCompleted` UInt32
`PStateCompletionCount` UInt64

Event ID 108: Command issued.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: CommandIssued

Description

Command issued.

Message #

Command issued.
SD Host Physical Address: %1
Command: %2
Argument: %3
Size: %4

Fields #

Name	Description
`SDHostPhysicalAddress` HexInt64
`Command` UInt8
`Argument` HexInt64
`Size` UInt64

Event ID 109: Command completed.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: CommandCompleted

Description

Command completed.

Message #

Command completed.
SD Host Physical Address: %1
Command: %2
Argument: %3
Size: %4

Fields #

Name	Description
`SDHostPhysicalAddress` HexInt64
`Command` UInt8
`Argument` HexInt64
`Size` UInt64

Event ID 110: Hpi CMD sent to the hardware.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: HPICMDIssued

Description

Hpi CMD sent to the hardware. IRP Irp.

Message #

Hpi CMD sent to the hardware. IRP %1

Fields #

Name	Description
`Irp` HexInt64

Event ID 111: Hpi CMD was accepted by the hardware.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: HPICMDIssued

Description

Hpi CMD was accepted by the hardware. IRP Irp.

Message #

Hpi CMD was accepted by the hardware. IRP %1

Fields #

Name	Description
`Irp` HexInt64

Event ID 112: Hpi CMD worker started.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: HPIWorkerProcess

Description

Hpi CMD worker started. IRP Irp.

Message #

Hpi CMD worker started. IRP %1

Fields #

Name	Description
`Irp` HexInt64

Event ID 113: Hpi CMD worker exited.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: HPIWorkerProcess

Description

Hpi CMD worker exited. IRP Irp Reason: HpiExitReason.

Message #

Hpi CMD worker exited. IRP %1 Reason: %2

Fields #

Name	Description
`Irp` HexInt64
`HpiExitReason` UInt32

Event ID 114: P-State change requested.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: P_StateUtilization

Description

P-State change requested.

Message #

P-State change requested.
PoFx Device Handle: %1
P-State Active Percentage: %2
P-State Active Duration: %3
P-State Sample Duration: %4
P-State Current Frequency: %5
P-State Requested Frequency: %6

Fields #

Name	Description
`PoFxDeviceHandle` HexInt64
`PStateActivePercent` UInt32
`PStateActiveDuration` UInt32
`PStateSampleDuration` UInt32
`PStateCurrentFrequency` UInt32
`PStateRequestedFrequency` UInt32

Event ID 115: SdbusWorkerDpcEnter: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Workpacket Function: WorkPacketWorkerProcFunction CurrentState: WorkEngineCurrentState FunctionPhase: WorkEngineFunctio...

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: SdbusWorkerDpc

Description

SdbusWorkerDpcEnter: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Workpacket Function: WorkPacketWorkerProcFunction CurrentState: WorkEngineCurrentState FunctionPhase: WorkEngineFunctionPhase.

Message #

SdbusWorkerDpcEnter: SD Host Physical Address: %1 Irp: %2 Workpacket Function: %3 CurrentState: %4 FunctionPhase: %5

Fields #

Name	Description
`SDHostPhysicalAddress` HexInt64
`Irp` Pointer
`WorkPacketWorkerProcFunction` UInt32
`WorkEngineCurrentState` HexInt32
`WorkEngineFunctionPhase` HexInt32

Event ID 116: SdbusWorkerDpcExit: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Workpacket Function: WorkPacketWorkerProcFunction CurrentState: WorkEngineCurrentState FunctionPhase: WorkEngineFunction...

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: SdbusWorkerDpc

Description

SdbusWorkerDpcExit: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Workpacket Function: WorkPacketWorkerProcFunction CurrentState: WorkEngineCurrentState FunctionPhase: WorkEngineFunctionPhase.

Message #

SdbusWorkerDpcExit: SD Host Physical Address: %1 Irp: %2 Workpacket Function: %3 CurrentState: %4 FunctionPhase: %5

Fields #

Name	Description
`SDHostPhysicalAddress` HexInt64
`Irp` Pointer
`WorkPacketWorkerProcFunction` UInt32
`WorkEngineCurrentState` HexInt32
`WorkEngineFunctionPhase` HexInt32

Event ID 117: SdbusRequestStart: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Cmd: WorkEngineCommand Arg: WorkEngineArgument Status: Status.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: SdbusRequest

Description

SdbusRequestStart: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Cmd: WorkEngineCommand Arg: WorkEngineArgument Status: Status.

Message #

SdbusRequestStart: SD Host Physical Address: %1 Irp: %2 Cmd: %3 Arg: %4 Status: %5

Fields #

Name	Description
`SDHostPhysicalAddress` HexInt64
`Irp` Pointer
`WorkEngineCommand` HexInt32
`WorkEngineArgument` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 118: SdbusRequestComplete: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Cmd: WorkEngineCommand Arg WorkEngineArgument Status Status.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: SdbusRequest

Description

SdbusRequestComplete: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Cmd: WorkEngineCommand Arg WorkEngineArgument Status Status.

Message #

SdbusRequestComplete: SD Host Physical Address: %1 Irp: %2 Cmd: %3 Arg %4 Status %5

Fields #

Name	Description
`SDHostPhysicalAddress` HexInt64
`Irp` Pointer
`WorkEngineCommand` HexInt32
`WorkEngineArgument` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 119: Scheduled callback routine.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: CallbackRoutine
Opcode: Start

Description

Scheduled callback routine.

Message #

Scheduled callback routine.
SD Host Physical Address: %1

Fields #

Name	Description
`SDHostPhysicalAddress` HexInt64

Event ID 120: Interrupt DPC scheduled.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: Interrupt
Opcode: Start

Description

Interrupt DPC scheduled.

Message #

Interrupt DPC scheduled.

Event ID 121: Interrupt DPC entered.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: Interrupt
Opcode: Start

Description

Interrupt DPC entered.

Message #

Interrupt DPC entered.

Event ID 122: Interrupt DPC exited.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: Interrupt
Opcode: Start

Description

Interrupt DPC exited.

Message #

Interrupt DPC exited.

Event ID 123: SdbusRequestStartV2: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Cmd: WorkEngineCommand Arg: WorkEngineArgument Status: Status UpperArg: WorkEngineArgument64.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: SdbusRequest

Description

SdbusRequestStartV2: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Cmd: WorkEngineCommand Arg: WorkEngineArgument Status: Status UpperArg: WorkEngineArgument64.

Message #

SdbusRequestStartV2: SD Host Physical Address: %1 Irp: %2 Cmd: %3 Arg: %4 Status: %5 UpperArg: %6

Fields #

Name	Description
`SDHostPhysicalAddress` HexInt64
`Irp` Pointer
`WorkEngineCommand` HexInt32
`WorkEngineArgument` HexInt32
`Status` HexInt32	NTSTATUS reference
`WorkEngineArgument64` HexInt64

Event ID 123

Provider: Microsoft-Windows-Sdbus
Channel: Operational
Task: SdbusRequest

Description

SdbusRequestStartV2: SD Host Physical Address: Irp: Cmd: Arg: Status: UpperArg.

Fields #

Name	Description
`SDHostPhysicalAddress` HexInt64
`Irp` Pointer
`WorkEngineCommand` HexInt32
`WorkEngineArgument` HexInt32
`Status` HexInt32	NTSTATUS reference
`WorkEngineArgument64` HexInt64

Event ID 124: SdbusRequestCompleteV2: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Cmd: WorkEngineCommand Arg WorkEngineArgument Status Status UpperArg: WorkEngineArgument64.

Provider: Microsoft-Windows-Sdbus
Channel: Analytic
Task: SdbusRequest

Description

SdbusRequestCompleteV2: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Cmd: WorkEngineCommand Arg WorkEngineArgument Status Status UpperArg: WorkEngineArgument64.

Message #

SdbusRequestCompleteV2: SD Host Physical Address: %1 Irp: %2 Cmd: %3 Arg %4 Status %5 UpperArg: %6

Fields #

Name	Description
`SDHostPhysicalAddress` HexInt64
`Irp` Pointer
`WorkEngineCommand` HexInt32
`WorkEngineArgument` HexInt32
`Status` HexInt32	NTSTATUS reference
`WorkEngineArgument64` HexInt64

Event ID 124

Provider: Microsoft-Windows-Sdbus
Channel: Operational
Task: SdbusRequest

Description

SdbusRequestCompleteV2: SD Host Physical Address: Irp: Cmd: Arg Status UpperArg.

Fields #

Name	Description
`SDHostPhysicalAddress` HexInt64
`Irp` Pointer
`WorkEngineCommand` HexInt32
`WorkEngineArgument` HexInt32
`Status` HexInt32	NTSTATUS reference
`WorkEngineArgument64` HexInt64

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID fe28004e-b08f-4407-92b3-bad3a2c51708

Defined in sdbus.sys, the binary that emits these events.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)