Microsoft-Windows-SleepStudy

32 events across 1 channel

Event	Title	Channel	Sample
1	ScenarioBlocker_V1	Diagnostic	N
2	ScenarioBlockerData_V1	Diagnostic	N
3	TopOffendersPerfTrack	Diagnostic	N
4	SubsystemContextInfo	Diagnostic	N
5	ScenarioBlockerVerboseAccounting_V1	Diagnostic	N
6	ScenarioBlockerDetailed	Diagnostic	N
7	ScenarioExitReason	Diagnostic	N
8	ScenarioStartReason	Diagnostic	N
9	ScenarioStopReason_V1	Diagnostic	N
10	ScenarioDeviceRundown_V1	Diagnostic	N
11	ScenarioComponentAccounting	Diagnostic	N
12	ScenarioDeviceAccounting	Diagnostic	N
13	ScenarioDripsWakeAccounting	Diagnostic	N
14	ScenarioSessionSwitch	Diagnostic	N
15	SystemStartControl	Diagnostic	N
16	SystemStopControl	Diagnostic	N
17	PreSleepNotificationControl	Diagnostic	N
18	PostSleepNotificationControl	Diagnostic	N
19	DirtyTransitionControl	Diagnostic	N
20	CsEnterReasonControl	Diagnostic	N
21	CsExitReasonControl	Diagnostic	N
22	ShutdownActionControl	Diagnostic	N
23	BatteryCountChangeControl	Diagnostic	N
24	AcDcStateChangeControl	Diagnostic	N
25	BootBatteryStatusControl	Diagnostic	N
26	BlockerStateChange	Diagnostic	Y
27	CollectionStateChange	Diagnostic	N
28	BlockerStateRundown	Diagnostic	N
29	CollectionStateRundown	Diagnostic	N
30	BlockerCreated	Diagnostic	Y
31	BlockerDeleted	Diagnostic	Y
32	SessionStateRundown	Diagnostic	N

Event ID 1: ScenarioBlocker_V1

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: ScenarioBlocker

Fields #

Name	Description
`ScenarioInstanceId` UInt8
`ParentGuid` GUID
`BlockerNameLength` UInt32
`BlockerName` UnicodeString
`BlockerGuid` GUID
`ActiveTime` UInt64
`ScenarioInstanceIdV2` UInt64
`Flags` UInt64

Event ID 2: ScenarioBlockerData_V1

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: ScenarioBlockerData

Fields #

Name	Description
`ScenarioInstanceId` UInt8
`DataCount` UInt32
`Data` UInt8
`ScenarioInstanceIdV2` UInt64

Event ID 3: TopOffendersPerfTrack

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: TopOffendersPerfTrack

Fields #

Name	Description
`ActiveTimeAndCommonData` UInt32
`TopLevelActiveTime` UInt32
`BlockerHierarchyLevel1` UnicodeString
`BlockerHierarchyLevel2` UnicodeString
`BlockerHierarchyLevel3` UnicodeString

Event ID 4: SubsystemContextInfo

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: SubsystemContextInfo

Fields #

Name	Description
`DataCount` UInt32
`Data` AnsiString

Event ID 5: ScenarioBlockerVerboseAccounting_V1

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: ScenarioBlockerVerboseAccounting

Fields #

Name	Description
`ScenarioId` UInt64
`BlockerGuid` GUID
`ParentBlockerGuid` GUID
`ActiveTime` UInt64
`ActiveTimeBuckets` UInt32
`ActiveTimePerBucket` UInt64
`UnattributedActiveTimeBuckets` UInt32
`UnattributedActiveTimePerBucket` UInt64
`NonActiveTime` UInt64
`NonActiveTimeBuckets` UInt32
`NonActiveTimePerBucket` UInt64
`UnattributedNonActiveTimeBuckets` UInt32
`UnattributedNonActiveTimePerBucket` UInt64
`BlockerType` UInt32
`DeviceClassNameLength` UInt32
`DeviceClassName` UnicodeString
`DeviceClassGuidLength` UInt32
`DeviceClassGuid` UnicodeString
`DeviceHardwareIdLength` UInt32
`DeviceHardwareId` UnicodeString
`Flags` UInt64

Event ID 6: ScenarioBlockerDetailed

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: ScenarioBlockerDetailed

Fields #

Name	Description
`ScenarioInstanceId` UInt64
`ParentGuid` GUID
`BlockerNameLength` UInt32
`BlockerName` UnicodeString
`BlockerGuid` GUID
`ActiveTime` UInt64
`ResourceId` UInt16
`ResourceFileNameLength` UInt32
`ResourceFileName` UnicodeString
`SubstitutionStringCount` UInt32
`SubstitutionStrings` Double
`Flags` UInt64

Event ID 7: ScenarioExitReason

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: ScenarioExitReason

Fields #

Name	Description
`EnergyDrain` UInt32
`ActiveResidencyInUs` UInt64
`NonDripsTimeActivatedInUs` UInt64
`FirstDripsEntryInUs` UInt64
`DripsResidencyInUs` UInt64
`DurationInUs` UInt64
`DripsTransitions` UInt32
`FullChargeCapacityRatio` UInt8
`AudioPlaying` Boolean
`Reason` UInt32
`AudioPlaybackInUs` UInt64
`NonActivatedCpuInUs` UInt64
`PowerStateAc` Boolean
`HwDripsResidencyInUs` UInt64
`ExitLatencyInUs` UInt64
`DisconnectedStandby` Boolean
`AoAcCompliantNic` Boolean
`NonAttributedCpuInUs` UInt64
`ModernSleepEnabledActionsBitmask` UInt32
`ModernSleepAppliedActionsBitmask` UInt32
`LidOpenState` Boolean
`ExternalMonitorConnectedState` Boolean
`ScenarioInstanceId` UInt8
`IsCsSessionInProgressOnExit` Boolean
`BatteryRemainingCapacityOnExit` UInt32
`BatteryFullChargeCapacityOnExit` UInt32
`ScenarioInstanceIdV2` UInt64
`BootId` UInt32
`InputSuppressionActionCount` UInt32
`NonResiliencyTimeInUs` UInt64
`ResiliencyDripsTimeInUs` UInt64
`ResiliencyHwDripsTimeInUs` UInt64
`GdiOnTime` UInt64
`DwmSyncFlushTime` UInt64
`MonitorPowerOnTime` UInt64
`SleepEntered` Boolean
`ScreenOffEnergyCapacityAtStart` UInt32
`ScreenOffEnergyCapacityAtEnd` UInt32
`ScreenOffDurationInUs` UInt64
`SleepEnergyCapacityAtStart` UInt32
`SleepEnergyCapacityAtEnd` UInt32
`SleepDurationInUs` UInt64
`ScreenOffFullEnergyCapacityAtStart` UInt32
`ScreenOffFullEnergyCapacityAtEnd` UInt32
`SleepFullEnergyCapacityAtStart` UInt32
`SleepFullEnergyCapacityAtEnd` UInt32
`PowerSchemeInfo` UInt32
`PowerButtonSuppressionActionCount` UInt32

Event ID 8: ScenarioStartReason

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: ScenarioStartReason

Fields #

Name	Description
`ScenarioGuid` GUID
`ScenarioInstanceId` UInt8
`CsEnterReason` UInt32
`BatteryRemainingCapacityOnEnter` UInt32
`BatteryFullChargeCapacityOnEnter` UInt32
`ScenarioInstanceIdV2` UInt64
`BootId` UInt32
`CurrentSystemTime` Int64
`LidOpenState` UInt8

Event ID 9: ScenarioStopReason_V1

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: ScenarioStopReason

Fields #

Name	Description
`EnergyDrain` UInt32
`DripsResidencyInUs` UInt64
`OnAc` Boolean
`HwDripsResidencyInUs` UInt64
`PreVetoCount` UInt64
`VetoCount` UInt64
`DurationInUs` UInt64
`FullChargeCapacity` UInt32
`NonActivatedCpuInUs` UInt64
`IRTruncatePercentage` UInt8
`DesignCapacity` UInt32
`AudioDurationInUs` UInt64
`Reason` UInt32
`DisconnectedStandby` Boolean
`AoAcCompliantNic` Boolean
`NonAttributedCpuInUs` UInt64
`EnergySaverPolicy` Boolean
`VideoTimeoutInSec` UInt32
`LockConsoleTimeoutInSec` UInt32
`StandbyTimeoutInSec` UInt32
`ModernSleepEnabledActionsBitmask` UInt32
`ModernSleepAppliedActionsBitmask` UInt32
`EnergyDrainV2Flags` UInt32
`EnergyDrainV2` Int64
`DirectedDripsTransitionCount` UInt32
`IsHibernateEnabled` Boolean
`HibernateTimeoutInSec` UInt32
`HibernateBudgetPercentage` UInt32
`IsLockConsoleTimeoutActive` Boolean
`IsDebuggerEnabled` Boolean
`ScenarioInstanceId` UInt64
`RemainingSleepTimeoutInSeconds` UInt32
`IdleTimeoutSource` UInt32
`DripsTransitions` UInt32
`UserConnectivitySetting` UInt32
`RemoteDesktopEnabled` Boolean
`BIRequestActive` Boolean
`TimerRebaseThresholdInSec` UInt32
`CumulativeTimerRebaseInUs` UInt64
`AusterityMode` UInt32
`LidOpenState` UInt8
`NonDripsIdleCpuInUs` UInt64
`ScreenOffSwDripsResidencyInUs` UInt64
`ScreenOffHwDripsResidencyInUs` UInt64
`SleepSwDripsResidencyInUs` UInt64
`SleepHwDripsResidencyInUs` UInt64

Event ID 10: ScenarioDeviceRundown_V1

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: ScenarioDeviceRundown

Fields #

Name	Description
`DeviceNode` Pointer
`DeviceIdLength` UInt16
`DeviceId` UnicodeString
`InstancePathLength` UInt16
`InstancePath` UnicodeString
`ServiceNameLength` UInt16
`ServiceName` UnicodeString
`PlatformStateDependents` UInt32
`Pdo` Pointer
`ParentDeviceNode` Pointer
`Flags` UInt32
`FriendlyNameLength` UInt16
`FriendlyName` UnicodeString
`DripsRequiredState` UInt32
`ScenarioInstanceId` UInt64

Event ID 11: ScenarioComponentAccounting

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: ScenarioComponentAccounting

Fields #

Name	Description
`ScenarioInstanceId` UInt8
`DeviceNode` Pointer
`Component` UInt32
`ActiveTime` UInt64
`ScenarioInstanceIdV2` UInt64

Event ID 12: ScenarioDeviceAccounting

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: ScenarioDeviceAccounting

Fields #

Name	Description
`ScenarioInstanceId` UInt8
`DeviceNode` Pointer
`ActiveTime` UInt64
`ScenarioInstanceIdV2` UInt64

Event ID 13: ScenarioDripsWakeAccounting

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: ScenarioDripsWakeAccounting

Fields #

Name	Description
`CsSessionId` UInt8
`Count` UInt32
`IdleMinDurationInUs` UInt64
`IdleMaxDurationInUs` UInt64
`IdleTotalDurationInUs` UInt64
`ReasonDescriptionLength` UInt32
`ReasonDescription` UnicodeString
`GroupCount` UInt16
`Group` UInt64
`CsSessionIdV2` UInt64

Event ID 14: ScenarioSessionSwitch

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: ScenarioSessionSwitch

Fields #

Name	Description
`BootId` UInt32
`Reason` UInt32
`PreviousSessionId` UInt64
`PreviousSessionType` UInt32
`PreviousSessionDurationInUs` UInt64
`PreviousEnergyCapacityAtStart` UInt32
`PreviousFullEnergyCapacityAtStart` UInt32
`PreviousEnergyCapacityAtEnd` UInt32
`PreviousFullEnergyCapacityAtEnd` UInt32
`NextSessionId` UInt64
`NextSessionType` UInt32
`PowerStateAc` Boolean
`MonitorReason` UInt32

Event ID 15: SystemStartControl

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: SystemStartControl

Fields #

Name	Description
`Timestamp` UInt64

Event ID 16: SystemStopControl

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: SystemStopControl

Fields #

Name	Description
`Timestamp` UInt64
`BatteryRemainingCapacity` UInt32
`BatteryFullChargeCapacity` UInt32
`LidState` UInt8
`ExternalMonitorState` UInt8

Event ID 17: PreSleepNotificationControl

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: PreSleepNotificationControl

Fields #

Name	Description
`Timestamp` UInt64
`TargetState` UInt32
`EffectiveState` UInt32
`Reason` UInt32
`RemainingBatteryCapacity` UInt32
`MaxBatteryCapacity` UInt32
`LidState` UInt8
`RequestorCallerType` UInt32
`RequestorProcessId` UInt32
`RequestorServiceTag` UInt32
`RequestorDescriptionLength` UInt32
`RequestorDescription` UnicodeString
`ExternalMonitorState` UInt8

Event ID 18: PostSleepNotificationControl

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: PostSleepNotificationControl

Fields #

Name	Description
`Timestamp` UInt64
`ProgrammedWakeTimeAc` UInt64
`ProgrammedWakeTimeDc` UInt64
`WakeRequesterTypeAc` UInt32
`WakeRequesterTypeDc` UInt32
`RemainingBatteryCapacity` UInt32
`MaxBatteryCapacity` UInt32
`WakeSrcFriendlyNameLength` UInt32
`WakeSrcFriendlyName` UnicodeString
`WakeSrcClassNameLength` UInt32
`WakeSrcClassName` UnicodeString
`WakeSrcAttributeReason` UInt32

Event ID 19: DirtyTransitionControl

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: DirtyTransitionControl

Fields #

Name	Description
`Timestamp` UInt64
`BugcheckCode` UInt32
`BugcheckParameter1` Pointer
`BugcheckParameter2` Pointer
`BugcheckParameter3` Pointer
`BugcheckParameter4` Pointer
`SleepInProgress` UInt32
`PowerButtonTimestamp` UInt64
`BootAppStatus` UInt32
`Checkpoint` UInt8
`ConnectedStandbyInProgress` Boolean
`SystemSleepTransitionsToOn` UInt32
`CsEntryScenarioInstanceIdV2` UInt64
`CheckpointStatus` UInt8
`LongPowerButtonPressDetected` Boolean
`LidReliability` Boolean
`InputSuppressionState` UInt8
`PowerButtonSuppressionState` UInt8
`LidState` UInt8
`BootAppCheckpoint` UInt32

Event ID 20: CsEnterReasonControl

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: CsEnterReasonControl

Fields #

Name	Description
`Timestamp` UInt64
`Reason` UInt32
`BatteryRemainingCapacityOnEnter` UInt32
`BatteryFullChargeCapacityOnEnter` UInt32
`ScenarioInstanceIdV2` UInt64
`BootId` UInt32
`LidState` UInt8
`BatteryChargeLimitingMode` Boolean
`BatteryChargingStatePowerSupplyPresent` Boolean
`BatteryChargingStateAdequate` Boolean
`BatteryTripPointSupported` Boolean
`ExternalMonitorState` UInt8

Event ID 21: CsExitReasonControl

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: CsExitReasonControl

Fields #

Name	Description
`Timestamp` UInt64
`Reason` UInt32
`PowerStateAc` Boolean
`IsCsSessionInProgressOnExit` Boolean
`ScenarioInstanceIdV2` UInt64
`BootId` UInt32
`SleepEntered` Boolean
`ScreenOffEnergyCapacityAtStart` UInt32
`ScreenOffEnergyCapacityAtEnd` UInt32
`ScreenOffFullEnergyCapacityAtStart` UInt32
`ScreenOffFullEnergyCapacityAtEnd` UInt32
`ScreenOffDurationInUs` UInt64
`SleepEnergyCapacityAtStart` UInt32
`SleepEnergyCapacityAtEnd` UInt32
`SleepFullEnergyCapacityAtStart` UInt32
`SleepFullEnergyCapacityAtEnd` UInt32
`SleepDurationInUs` UInt64
`LidState` UInt8
`BatteryChargeLimitingMode` Boolean
`BatteryChargingStatePowerSupplyPresent` Boolean
`BatteryChargingStateAdequate` Boolean
`BatteryTripPointSupported` Boolean
`ExternalMonitorState` UInt8

Event ID 22: ShutdownActionControl

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: ShutdownActionControl

Fields #

Name	Description
`Timestamp` UInt64
`ShutdownActionType` UInt32
`ShutdownEventCode` UInt32
`ShutdownReason` UInt32

Event ID 23: BatteryCountChangeControl

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: BatteryCountChangeControl

Fields #

Name	Description
`Timestamp` UInt64
`ValidBatteryCount` UInt32
`ErrorBatteryCount` UInt32
`AbandonedBatteryCount` UInt32
`LidState` UInt8
`ExternalMonitorState` UInt8

Event ID 24: AcDcStateChangeControl

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: AcDcStateChangeControl

Fields #

Name	Description
`Timestamp` UInt64
`AcOnline` Boolean
`RemainingCapacity` UInt32
`FullChargeCapacity` UInt32
`LidState` UInt8
`ExternalMonitorState` UInt8

Event ID 25: BootBatteryStatusControl

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: BootBatteryStatusControl

Fields #

Name	Description
`Timestamp` UInt64
`RemainingCapacity` UInt32
`FullChargeCapacity` UInt32

Event ID 26: BlockerStateChange

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: BlockerStateChange
Opcode: win:Info

Fields #

Name	Description
`BlockerHandle` UInt64
`Timestamp` UInt64
`BlockerActive` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SleepStudy",
    "guid": "{D37687E7-8BF0-4D11-B589-A7ABE080756A}",
    "event_source_name": "",
    "event_id": 26,
    "version": 0,
    "level": 4,
    "task": 26,
    "opcode": 0,
    "keywords": "0x0000000000000004",
    "time_created": "2026-06-02T04:01:27.430+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1848,
      "thread_id": 5832
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "BlockerActive": true,
    "BlockerHandle": 18446670449064004320,
    "Timestamp": 1160969416232
  },
  "message": "BlockerStateChange"
}

Event ID 27: CollectionStateChange

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: CollectionStateChange

Fields #

Name	Description
`CollectionId` GUID
`Timestamp` UInt64
`CollectionActive` Boolean

Event ID 28: BlockerStateRundown

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: BlockerStateRundown

Fields #

Name	Description
`BlockerHandle` Pointer
`BlockerId` GUID
`ParentId` GUID
`CollectionId` GUID
`Timestamp` UInt64
`BlockerActive` Boolean
`BlockerNameLength` UInt32
`BlockerName` UnicodeString

Event ID 29: CollectionStateRundown

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: CollectionStateRundown

Fields #

Name	Description
`CollectionId` GUID
`Timestamp` UInt64
`CollectionActive` Boolean
`CollectionNameLength` UInt32
`CollectionName` UnicodeString

Event ID 30: BlockerCreated

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: BlockerCreated
Opcode: win:Info

Fields #

Name	Description
`BlockerHandle` Pointer
`BlockerId` GUID
`ParentId` GUID
`CollectionId` GUID
`Timestamp` UInt64
`BlockerActive` Boolean
`BlockerNameLength` UInt32
`BlockerName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SleepStudy",
    "guid": "{D37687E7-8BF0-4D11-B589-A7ABE080756A}",
    "event_source_name": "",
    "event_id": 30,
    "version": 0,
    "level": 4,
    "task": 30,
    "opcode": 0,
    "keywords": "0x0000000000000004",
    "time_created": "2026-06-02T04:01:27.430+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1848,
      "thread_id": 5832
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "BlockerActive": false,
    "BlockerHandle": "0xFFFFBD09ED27CAE0",
    "BlockerId": "{7950DD88-0000-0000-0000-000000000000}",
    "BlockerName": "svchost.exe",
    "BlockerNameLength": 11,
    "CollectionId": "{55633AD2-9475-4502-8E8C-8409F8075E8A}",
    "ParentId": "{AADDAADD-0006-0000-0000-000000000000}",
    "Timestamp": 1160969416232
  },
  "message": "BlockerCreated"
}

Event ID 31: BlockerDeleted

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: BlockerDeleted
Opcode: win:Info

Fields #

Name	Description
`BlockerHandle` Pointer
`BlockerId` GUID
`ParentId` GUID
`CollectionId` GUID
`Timestamp` UInt64
`BlockerActive` Boolean
`BlockerNameLength` UInt32
`BlockerName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-SleepStudy",
    "guid": "{D37687E7-8BF0-4D11-B589-A7ABE080756A}",
    "event_source_name": "",
    "event_id": 31,
    "version": 0,
    "level": 4,
    "task": 31,
    "opcode": 0,
    "keywords": "0x0000000000000004",
    "time_created": "2026-06-02T04:01:27.441+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1848,
      "thread_id": 5832
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "BlockerActive": false,
    "BlockerHandle": "0xFFFFBD09ED27CAE0",
    "BlockerId": "{7950DD88-0000-0000-0000-000000000000}",
    "BlockerName": "svchost.exe",
    "BlockerNameLength": 11,
    "CollectionId": "{55633AD2-9475-4502-8E8C-8409F8075E8A}",
    "ParentId": "{AADDAADD-0006-0000-0000-000000000000}",
    "Timestamp": 1160969511663
  },
  "message": "BlockerDeleted"
}

Event ID 32: SessionStateRundown

Provider: Microsoft-Windows-SleepStudy
Channel: Diagnostic
Task: SessionStateRundown

Fields #

Name	Description
`SessionId` UInt64
`SessionType` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {D37687E7-8BF0-4D11-B589-A7ABE080756A}

Defined in microsoft-windows-sleepstudy-events.dll, which carries the event manifest.

Observed on:

Win11-26200.6584, sample captured from a live trace, binary version 10.0.26100.4202, captured 2026-06-02
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4202, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-SleepStudy

Event ID 1: ScenarioBlocker_V1

Fields #

Event ID 2: ScenarioBlockerData_V1

Fields #

Event ID 3: TopOffendersPerfTrack

Fields #

Event ID 4: SubsystemContextInfo

Fields #

Event ID 5: ScenarioBlockerVerboseAccounting_V1

Fields #

Event ID 6: ScenarioBlockerDetailed

Fields #

Event ID 7: ScenarioExitReason

Fields #

Event ID 8: ScenarioStartReason

Fields #

Event ID 9: ScenarioStopReason_V1

Fields #

Event ID 10: ScenarioDeviceRundown_V1

Fields #

Event ID 11: ScenarioComponentAccounting

Fields #

Event ID 12: ScenarioDeviceAccounting

Fields #

Event ID 13: ScenarioDripsWakeAccounting

Fields #

Event ID 14: ScenarioSessionSwitch

Fields #

Event ID 15: SystemStartControl

Fields #

Event ID 16: SystemStopControl

Fields #

Event ID 17: PreSleepNotificationControl

Fields #

Event ID 18: PostSleepNotificationControl

Fields #

Event ID 19: DirtyTransitionControl

Fields #

Event ID 20: CsEnterReasonControl

Fields #

Event ID 21: CsExitReasonControl

Fields #

Event ID 22: ShutdownActionControl

Fields #

Event ID 23: BatteryCountChangeControl

Fields #

Event ID 24: AcDcStateChangeControl

Fields #

Event ID 25: BootBatteryStatusControl

Fields #

Event ID 26: BlockerStateChange

Fields #

Example Event #

Event ID 27: CollectionStateChange

Fields #

Event ID 28: BlockerStateRundown

Fields #

Event ID 29: CollectionStateRundown

Fields #

Event ID 30: BlockerCreated

Fields #

Example Event #

Event ID 31: BlockerDeleted

Fields #

Example Event #

Event ID 32: SessionStateRundown

Fields #

Provenance

Downloads