Microsoft-Windows-Search-ProtocolHandlers
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 28 | MapiEmailItemStart | Diagnostic | N | N |
| 29 | MapiEmailItemStop | Diagnostic | N | N |
| 30 | CSCDocumentStart | Diagnostic | N | N |
| 31 | CSCDocumentStop | Diagnostic | N | N |
| 34 | MapiOpenMessageStart | Diagnostic | N | N |
| 35 | MapiOpenMessageStop | Diagnostic | N | N |
| 36 | MapiGetAttachmentFromMessageStart | Diagnostic | N | N |
| 37 | MapiGetAttachmentFromMessageStop | Diagnostic | N | N |
| 38 | MapiEnumerateAttachmentsStart | Diagnostic | N | N |
| 39 | MapiEnumerateAttachmentsStop | Diagnostic | N | N |
| 40 | MapiGetMapiFpsPropValsStart | Diagnostic | N | N |
| 41 | MapiGetMapiFpsPropValsStop | Diagnostic | N | N |
| 58 | FilterOplockBreak | Diagnostic | N | N |
| 62 | FilterOplockFail | Diagnostic | N | N |
Event ID 28: MapiEmailItemStart
#Event ID 29: MapiEmailItemStop
#Event ID 30: CSCDocumentStart
#Event ID 31: CSCDocumentStop
#Event ID 34: MapiOpenMessageStart
#Event ID 35: MapiOpenMessageStop
#Event ID 36: MapiGetAttachmentFromMessageStart
#Event ID 37: MapiGetAttachmentFromMessageStop
#Event ID 38: MapiEnumerateAttachmentsStart
#Event ID 39: MapiEnumerateAttachmentsStop
#Event ID 40: MapiGetMapiFpsPropValsStart
#Event ID 41: MapiGetMapiFpsPropValsStop
#Provenance
ETW provider GUID dab065a9-620f-45ba-b5d6-d6bb8efedee9
Defined in SearchIndexer.exe, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 7.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 7.0.26100.4946, captured 2026-06-02 — Manifest XML pack, 2.0 MB