Microsoft-Windows-UI-Input-Inking

42 events across 1 channel

Event	Title	Channel	Sample
1	Inking_IStrokeBuilder_BeginStrokeStart	Operational	N
2	Inking_IStrokeBuilder_BeginStrokeStop	Operational	N
3	Inking_IStrokeBuilder_AppendStrokeStart	Operational	N
4	Inking_IStrokeBuilder_AppendStrokeStop	Operational	N
5	Inking_IStrokeBuilder_EndStrokeStart	Operational	N
6	Inking_IStrokeBuilder_EndStrokeStop	Operational	N
7	Inking_IStrokeCollection_AddStrokeStart	Operational	N
8	Inking_IStrokeCollection_AddStrokeStop	Operational	N
9	Inking_IStrokeCollection_DeleteStrokeStart	Operational	N
10	Inking_IStrokeCollection_DeleteStrokeStop	Operational	N
11	Inking_IStrokeCollection_SelectWithPolyLineStart	Operational	N
12	Inking_IStrokeCollection_SelectWithPolyLineStop	Operational	N
13	Inking_IStrokeCollection_SelectWithLineStart	Operational	N
14	Inking_IStrokeCollection_SelectWithLineStop	Operational	N
15	Inking_IStrokeCollection_CopyStart	Operational	N
16	Inking_IStrokeCollection_CopyStop	Operational	N
17	Inking_IStrokeCollection_PasteStart	Operational	N
18	Inking_IStrokeCollection_PasteStop	Operational	N
19	Inking_IStrokeCollection_SerializeStart	Operational	N
20	Inking_IStrokeCollection_SerializeStop	Operational	N
21	Inking_IStrokeCollection_DeserializeStart	Operational	N
22	Inking_IStrokeCollection_DeserializeStop	Operational	N
23	Inking_IRecognizerCollection_SetDefaultRecognizerStart	Operational	N
24	Inking_IRecognizerCollection_SetDefaultRecognizerStop	Operational	N
25	Inking_IRecognizerCollection_RecognizeStart	Operational	N
26	Inking_IRecognizerCollection_RecognizeStop	Operational	N
27	Inking_IRecognizerCollection_GetRecognizerViewStart	Operational	N
28	Inking_IRecognizerCollection_GetRecognizerViewStop	Operational	N
29	Inking_IInkManager_OnPointerDownStart	Operational	N
30	Inking_IInkManager_OnPointerDownStop	Operational	N
31	Inking_IInkManager_OnPointerUpdateStart	Operational	N
32	Inking_IInkManager_OnPointerUpdateStop	Operational	N
33	Inking_IInkManager_OnPointerUpStart	Operational	N
34	Inking_IInkManager_OnPointerUpStop	Operational	N
35	Inking_IInkManager_RecognizeStart	Operational	N
36	Inking_IInkManager_RecognizeStop	Operational	N
37	Inking_IStroke_GetStrokeRenderingSegmentViewStart	Operational	N
38	Inking_IStroke_GetStrokeRenderingSegmentViewStop	Operational	N
39	Inking_IStrokeCollection_GetRecognitionResultViewStart	Operational	N
40	Inking_IStrokeCollection_GetRecognitionResultViewStop	Operational	N
41	Inking_IStrokeBuilder_CreateStrokeStart	Operational	N
42	Inking_IStrokeBuilder_CreateStrokeStop	Operational	N

Event ID 1: Inking_IStrokeBuilder_BeginStrokeStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeBuilder_BeginStroke
Opcode: Start

Event ID 2: Inking_IStrokeBuilder_BeginStrokeStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeBuilder_BeginStroke
Opcode: Stop

Event ID 3: Inking_IStrokeBuilder_AppendStrokeStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeBuilder_AppendStroke
Opcode: Start

Event ID 4: Inking_IStrokeBuilder_AppendStrokeStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeBuilder_AppendStroke
Opcode: Stop

Event ID 5: Inking_IStrokeBuilder_EndStrokeStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeBuilder_EndStroke
Opcode: Start

Event ID 6: Inking_IStrokeBuilder_EndStrokeStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeBuilder_EndStroke
Opcode: Stop

Event ID 7: Inking_IStrokeCollection_AddStrokeStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeCollection_AddStroke
Opcode: Start

Event ID 8: Inking_IStrokeCollection_AddStrokeStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeCollection_AddStroke
Opcode: Stop

Event ID 9: Inking_IStrokeCollection_DeleteStrokeStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeCollection_DeleteStroke
Opcode: Start

Event ID 10: Inking_IStrokeCollection_DeleteStrokeStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeCollection_DeleteStroke
Opcode: Stop

Event ID 11: Inking_IStrokeCollection_SelectWithPolyLineStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeCollection_SelectWithPolyLine
Opcode: Start

Event ID 12: Inking_IStrokeCollection_SelectWithPolyLineStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeCollection_SelectWithPolyLine
Opcode: Stop

Event ID 13: Inking_IStrokeCollection_SelectWithLineStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeCollection_SelectWithLine
Opcode: Start

Event ID 14: Inking_IStrokeCollection_SelectWithLineStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeCollection_SelectWithLine
Opcode: Stop

Event ID 15: Inking_IStrokeCollection_CopyStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeCollection_Copy
Opcode: Start

Event ID 16: Inking_IStrokeCollection_CopyStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeCollection_Copy
Opcode: Stop

Event ID 17: Inking_IStrokeCollection_PasteStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeCollection_Paste
Opcode: Start

Event ID 18: Inking_IStrokeCollection_PasteStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeCollection_Paste
Opcode: Stop

Event ID 19: Inking_IStrokeCollection_SerializeStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeCollection_Serialize
Opcode: Start

Event ID 20: Inking_IStrokeCollection_SerializeStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeCollection_Serialize
Opcode: Stop

Event ID 21: Inking_IStrokeCollection_DeserializeStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeCollection_Deserialize
Opcode: Start

Event ID 22: Inking_IStrokeCollection_DeserializeStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeCollection_Deserialize
Opcode: Stop

Event ID 23: Inking_IRecognizerCollection_SetDefaultRecognizerStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IRecognizerCollection_SetDefaultRecognizer
Opcode: Start

Event ID 24: Inking_IRecognizerCollection_SetDefaultRecognizerStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IRecognizerCollection_SetDefaultRecognizer
Opcode: Stop

Event ID 25: Inking_IRecognizerCollection_RecognizeStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IRecognizerCollection_Recognize
Opcode: Start

Event ID 26: Inking_IRecognizerCollection_RecognizeStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IRecognizerCollection_Recognize
Opcode: Stop

Event ID 27: Inking_IRecognizerCollection_GetRecognizerViewStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IRecognizerCollection_GetRecognizerView
Opcode: Start

Event ID 28: Inking_IRecognizerCollection_GetRecognizerViewStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IRecognizerCollection_GetRecognizerView
Opcode: Stop

Event ID 29: Inking_IInkManager_OnPointerDownStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IInkManager_OnPointerDown
Opcode: Start

Event ID 30: Inking_IInkManager_OnPointerDownStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IInkManager_OnPointerDown
Opcode: Stop

Event ID 31: Inking_IInkManager_OnPointerUpdateStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IInkManager_OnPointerUpdate
Opcode: Start

Event ID 32: Inking_IInkManager_OnPointerUpdateStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IInkManager_OnPointerUpdate
Opcode: Stop

Event ID 33: Inking_IInkManager_OnPointerUpStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IInkManager_OnPointerUp
Opcode: Start

Event ID 34: Inking_IInkManager_OnPointerUpStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IInkManager_OnPointerUp
Opcode: Stop

Event ID 35: Inking_IInkManager_RecognizeStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IInkManager_Recognize
Opcode: Start

Event ID 36: Inking_IInkManager_RecognizeStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IInkManager_Recognize
Opcode: Stop

Event ID 37: Inking_IStroke_GetStrokeRenderingSegmentViewStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStroke_GetStrokeRenderingSegmentView
Opcode: Start

Event ID 38: Inking_IStroke_GetStrokeRenderingSegmentViewStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStroke_GetStrokeRenderingSegmentView
Opcode: Stop

Event ID 39: Inking_IStrokeCollection_GetRecognitionResultViewStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeCollection_GetRecognitionResultView
Opcode: Start

Event ID 40: Inking_IStrokeCollection_GetRecognitionResultViewStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeCollection_GetRecognitionResultView
Opcode: Stop

Event ID 41: Inking_IStrokeBuilder_CreateStrokeStart

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeBuilder_CreateStroke
Opcode: Start

Event ID 42: Inking_IStrokeBuilder_CreateStrokeStop

Provider: Microsoft-Windows-UI-Input-Inking
Channel: Operational
Task: Inking_IStrokeBuilder_CreateStroke
Opcode: Stop

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID bf1db390-3e67-4d4d-a287-8958044a3db4

Defined in Windows.UI.Input.Inking.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)