Microsoft-Windows-Security-SPP-UX

Event	Title	Channel	Sample	Rule
100	Security_SPP_UX_ResolveStart	Analytic	N	N
101	Security_SPP_UX_ResolveStop	Analytic	N	N
200	Security_SPP_UX_ActivateStart	Analytic	N	N
201	Security_SPP_UX_ActivateStop	Analytic	N	N
300	Security_SPP_UX_NotifyUserStart	Analytic	N	N
301	Security_SPP_UX_NotifyUserStop	Analytic	N	N

Event ID 100: Security_SPP_UX_ResolveStart

Channel: Analytic
Task: Security_SPP_UX_Resolve
Opcode: Start

Event ID 101: Security_SPP_UX_ResolveStop

Channel: Analytic
Task: Security_SPP_UX_Resolve
Opcode: Stop

Event ID 200: Security_SPP_UX_ActivateStart

Channel: Analytic
Task: Security_SPP_UX_Activate
Opcode: Start

Event ID 201: Security_SPP_UX_ActivateStop

Channel: Analytic
Task: Security_SPP_UX_Activate
Opcode: Stop

Event ID 300: Security_SPP_UX_NotifyUserStart

Channel: Analytic
Task: Security_SPP_UX_NotifyUser
Opcode: Start

Event ID 301: Security_SPP_UX_NotifyUserStop

Channel: Analytic
Task: Security_SPP_UX_NotifyUser
Opcode: Stop

Provenance

ETW provider GUID 6bdadc96-673e-468c-9f5b-f382f95b2832

Defined in slui.exe, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4294, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4202, captured 2026-06-02 — Manifest XML pack, 2.0 MB