detection.wiki

Microsoft-Windows-SoftwareInventoryLogging-Provider

EventTitleChannelSampleRule
1001Provider loaded.OperationalNN
1002Provider unloaded.OperationalNN
1003GetTargetUri started.OperationalNN
1004GetTargetUri started.OperationalNN
1005GetTargetUri error.OperationalNN
1006SetTargetUri started.OperationalNN
1007SetTargetUri stopped.OperationalNN
1008SetTargetUri error.OperationalNN
1009GetLoggingState started.OperationalNN
1010GetLoggingState stopped.OperationalNN
1011GetLoggingState error.OperationalNN
1012SetLoggingState started.OperationalNN
1013SetLoggingState stopped.OperationalNN
1014SetLoggingState error.OperationalNN
1015GetLoggingTime started.OperationalNN
1016GetLoggingTime stopped.OperationalNN
1017GetLoggingTime error.OperationalNN
1018SetLoggingTime started.OperationalNN
1019SetLoggingTime stopped.OperationalNN
1020SetLoggingTime error.OperationalNN
1030Enumerate Server started.OperationalNN
1031Enumerate Server stopped.OperationalNN
1032Enumerate Server error.OperationalNN
1033Enumerate QFE started.OperationalNN
1034Enumerate QFE stopped.OperationalNN
1035Enumerate QFE error.OperationalNN
1036Enumerate Software started.OperationalNN
1037Enumerate Software stopped.OperationalNN
1038Enumerate Software error.OperationalNN
1039Enumerate UAL Access started.OperationalNN
1040Enumerate UAL Access stopped.OperationalNN
1041Enumerate UAL Access error.OperationalNN
1042Get Guest Data started.OperationalNN
1043Get Guest Data stopped.OperationalNN
1044Get Guest Data error.OperationalNN
1045Get Guest Data warning.OperationalNN
1100Deserialize guest data started.DebugNN
1101Deserialize guest data stopped.DebugNN

Event ID 1001: Provider loaded.

#
Channel
Operational
Task
Lifetime
Opcode
Start

Event ID 1002: Provider unloaded.

#
Channel
Operational
Task
Lifetime
Opcode
Stop

Event ID 1003: GetTargetUri started.

#
Channel
Operational
Task
Lifetime
Opcode
Start

Event ID 1004: GetTargetUri started.

#
Channel
Operational
Task
Lifetime
Opcode
Stop

Event ID 1005: GetTargetUri error.

#
Channel
Operational
Task
Lifetime

Event ID 1006: SetTargetUri started.

#
Channel
Operational
Task
Lifetime
Opcode
Start

Event ID 1007: SetTargetUri stopped.

#
Channel
Operational
Task
Lifetime
Opcode
Stop

Event ID 1008: SetTargetUri error.

#
Channel
Operational
Task
Lifetime

Event ID 1009: GetLoggingState started.

#
Channel
Operational
Task
Lifetime
Opcode
Start

Event ID 1010: GetLoggingState stopped.

#
Channel
Operational
Task
Lifetime
Opcode
Stop

Event ID 1011: GetLoggingState error.

#
Channel
Operational
Task
Lifetime

Event ID 1012: SetLoggingState started.

#
Channel
Operational
Task
Lifetime
Opcode
Start

Event ID 1013: SetLoggingState stopped.

#
Channel
Operational
Task
Lifetime
Opcode
Stop

Event ID 1014: SetLoggingState error.

#
Channel
Operational
Task
Lifetime

Event ID 1015: GetLoggingTime started.

#
Channel
Operational
Task
Lifetime
Opcode
Start

Event ID 1016: GetLoggingTime stopped.

#
Channel
Operational
Task
Lifetime
Opcode
Stop

Event ID 1017: GetLoggingTime error.

#
Channel
Operational
Task
Lifetime

Event ID 1018: SetLoggingTime started.

#
Channel
Operational
Task
Lifetime
Opcode
Start

Event ID 1019: SetLoggingTime stopped.

#
Channel
Operational
Task
Lifetime
Opcode
Stop

Event ID 1020: SetLoggingTime error.

#
Channel
Operational
Task
Lifetime

Event ID 1030: Enumerate Server started.

#
Channel
Operational
Task
Lifetime
Opcode
Start

Event ID 1031: Enumerate Server stopped.

#
Channel
Operational
Task
Lifetime
Opcode
Stop

Event ID 1032: Enumerate Server error.

#
Channel
Operational
Task
Lifetime

Description

Enumerate Server error. Error: error, Type: errorType, Message: errorMessage.

Message #

Enumerate Server error. Error: %1, Type: %2, Message: %3

Fields #

NameDescription
error UInt32
errorType UnicodeString
errorMessage UnicodeString

Event ID 1033: Enumerate QFE started.

#
Channel
Operational
Task
Lifetime
Opcode
Start

Event ID 1034: Enumerate QFE stopped.

#
Channel
Operational
Task
Lifetime
Opcode
Stop

Event ID 1035: Enumerate QFE error.

#
Channel
Operational
Task
Lifetime

Description

Enumerate QFE error. Error: error, Type: errorType, Message: errorMessage.

Message #

Enumerate QFE error.  Error: %1, Type: %2, Message: %3

Fields #

NameDescription
error UInt32
errorType UnicodeString
errorMessage UnicodeString

Event ID 1036: Enumerate Software started.

#
Channel
Operational
Task
Lifetime
Opcode
Start

Event ID 1037: Enumerate Software stopped.

#
Channel
Operational
Task
Lifetime
Opcode
Stop

Event ID 1038: Enumerate Software error.

#
Channel
Operational
Task
Lifetime

Description

Enumerate Software error. Error: error, Type: errorType, Message: errorMessage.

Message #

Enumerate Software error. Error: %1, Type: %2, Message: %3

Fields #

NameDescription
error UInt32
errorType UnicodeString
errorMessage UnicodeString

Event ID 1039: Enumerate UAL Access started.

#
Channel
Operational
Task
Lifetime
Opcode
Start

Event ID 1040: Enumerate UAL Access stopped.

#
Channel
Operational
Task
Lifetime
Opcode
Stop

Event ID 1041: Enumerate UAL Access error.

#
Channel
Operational
Task
Lifetime

Description

Enumerate UAL Access error. Error: error, Type: errorType, Message: errorMessage.

Message #

Enumerate UAL Access error. Error: %1, Type: %2, Message: %3

Fields #

NameDescription
error UInt32
errorType UnicodeString
errorMessage UnicodeString

Event ID 1042: Get Guest Data started.

#
Channel
Operational
Task
Lifetime
Opcode
Start

Event ID 1043: Get Guest Data stopped.

#
Channel
Operational
Task
Lifetime
Opcode
Stop

Event ID 1044: Get Guest Data error.

#
Channel
Operational
Task
Lifetime

Description

Get Guest Data error. Error: error, Type: errorType, Message: errorMessage.

Message #

Get Guest Data error. Error: %1, Type: %2, Message: %3

Fields #

NameDescription
error UInt32
errorType UnicodeString
errorMessage UnicodeString

Event ID 1045: Get Guest Data warning.

#
Channel
Operational
Task
Lifetime

Description

Get Guest Data warning. Failed to get guest FQDN. Guest may not be running. VM Guid: vmGuid.

Message #

Get Guest Data warning. Failed to get guest FQDN. Guest may not be running. VM Guid: %1.

Fields #

NameDescription
vmGuid UnicodeString

Event ID 1100: Deserialize guest data started.

#
Channel
Debug
Task
DataDecode

Description

Deserialize guest data started. VM Guid: vmGuid, File: tempFileName.

Message #

Deserialize guest data started. VM Guid: %1, File: %2.

Fields #

NameDescription
vmGuid UnicodeString
tempFileName UnicodeString

Event ID 1101: Deserialize guest data stopped.

#
Channel
Debug
Task
DataDecode

Description

Deserialize guest data stopped. VM Guid: vmGuid, File: tempFileName.

Message #

Deserialize guest data stopped. VM Guid: %1, File: %2.

Fields #

NameDescription
vmGuid UnicodeString
tempFileName UnicodeString

Provenance

ETW provider GUID 51f092c6-6573-4a9b-a7fc-a245ae653bd1

Defined in silprovider.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB