Microsoft-Windows-SPB-HIDI2C

Event	Title	Channel	Sample	Rule
1000	The HIDI2C driver has enumerated successfully	Analytic	N	N
1001	The HIDI2C driver failed to enumerate (Status).	Analytic	N	N
1002	The HIDI2C driver failed to enumerate (Status).	Analytic	N	N
1003	The HIDI2C driver failed to enumerate (Status).	Analytic	N	N
1010	IO request flow via the HIDI2C driver	Analytic	N	N
1011	IO request flow via the HIDI2C driver	Analytic	N	N
1012	IO request flow via the HIDI2C driver	Analytic	N	N
1013	IO request flow via the HIDI2C driver	Analytic	N	N
1014	IO request flow via the HIDI2C driver	Analytic	N	N
1020	Reset Command sent to HIDI2C device	Analytic	N	N
1021	Power Command (opcode:SpbIoTarget) sent to HIDI2C device.	Analytic	N	N

Event ID 1000: The HIDI2C driver has enumerated successfully

Channel: Analytic
Task: EnumerationoftheHIDI2Cdriver

Fields #

Name	Description
`DeviceObject` Pointer
`Status` UInt32	NTSTATUS reference

Event ID 1001: The HIDI2C driver failed to enumerate (Status).

Channel: Analytic
Task: EnumerationoftheHIDI2Cdriver

Message #

The HIDI2C driver failed to enumerate (%2)

Fields #

Name	Description
`DeviceObject` Pointer
`Status` UInt32	NTSTATUS reference

Event ID 1002: The HIDI2C driver failed to enumerate (Status).

Channel: Analytic
Task: EnumerationoftheHIDI2Cdriver

Message #

The HIDI2C driver failed to enumerate (%2)

Fields #

Name	Description
`DeviceObject` Pointer
`Status` UInt32	NTSTATUS reference

Event ID 1003: The HIDI2C driver failed to enumerate (Status).

Channel: Analytic
Task: EnumerationoftheHIDI2Cdriver

Message #

The HIDI2C driver failed to enumerate (%2)

Fields #

Name	Description
`DeviceObject` Pointer
`Status` UInt32	NTSTATUS reference

Event ID 1010: IO request flow via the HIDI2C driver

Channel: Analytic
Task: IOrequestflowviatheHIDI2Cdriver
Opcode: Start

Fields #

Name	Description
`Device` Pointer

Event ID 1011: IO request flow via the HIDI2C driver

Channel: Analytic
Task: IOrequestflowviatheHIDI2Cdriver
Opcode: IoSpbReadDispatch

Fields #

Name	Description
`Device` Pointer
`SpbIoTarget` Pointer
`SpbRequest` Pointer

Event ID 1012: IO request flow via the HIDI2C driver

Channel: Analytic
Task: IOrequestflowviatheHIDI2Cdriver
Opcode: IoSpbReadComplete

Fields #

Name	Description
`Device` Pointer
`SpbIoTarget` Pointer
`SpbRequest` Pointer

Event ID 1013: IO request flow via the HIDI2C driver

Channel: Analytic
Task: IOrequestflowviatheHIDI2Cdriver
Opcode: IoForwardToCompletionQueue

Fields #

Name	Description
`Device` Pointer
`HidReadRequest` Pointer

Event ID 1014: IO request flow via the HIDI2C driver

Channel: Analytic
Task: IOrequestflowviatheHIDI2Cdriver
Opcode: Stop

Fields #

Name	Description
`Device` Pointer
`HidReadRequest` Pointer

Event ID 1020: Reset Command sent to HIDI2C device

Channel: Analytic
Task: CommandrequestsintheHIDI2Cdriver

Fields #

Name	Description
`Device` Pointer
`SpbIoTarget` Pointer
`Opcode` UInt16
`Status` UInt32	NTSTATUS reference

Event ID 1021: Power Command (opcode:SpbIoTarget) sent to HIDI2C device.

Channel: Analytic
Task: CommandrequestsintheHIDI2Cdriver

Message #

Power Command (opcode:%2) sent to HIDI2C device

Fields #

Name	Description
`Device` Pointer
`SpbIoTarget` Pointer
`Opcode` UInt16
`Status` UInt32	NTSTATUS reference

Provenance

ETW provider GUID 991f8fe6-249d-44d6-b93d-5a3060c1dedb

Defined in hidi2c.sys, the binary that emits these events.

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4768, captured 2026-06-02 — Manifest XML pack, 2.0 MB