Microsoft-Windows-SEC-WFP

Not an independently readable Windows event log. Microsoft-Windows-SEC-WFP is an ETW trace provider defined in mssecwfp.sys, the Microsoft Defender for Endpoint kernel sensor: its events are delivered to a realtime trace session the sensor consumes, and surface as the Defender Advanced Hunting Device* tables (see /defender/). The manifest declares an Operational channel, but Windows registers no readable Event Log channel for it, so nothing here appears in Event Viewer or forwards over WEF. The event and field names below are manifest-derived. Present only where Microsoft Defender for Endpoint is onboarded.