detection.wiki

Microsoft-Windows-UserDataAccess-UserDataApis

EventTitleChannelSampleRule
1Error: HRESULT: P1_HResult Location: P2_String Line Number: P3_UInt32.OperationalNN
2Error Propagated: HRESULT: P1_HResult Location: P2_String Line Number: …OperationalNN
10Prop_UnicodeString.OperationalNN
100Opening VoIP RPC clientOperationalNN
101Opened VoIP RPC clientOperationalNN
102New incoming VoIP call Prop_HexInt32.OperationalNN
103New outgoing VoIP call Prop_HexInt32.OperationalNN
104Made DSS token Prop_UnicodeString_1 for file Prop_UnicodeString_2.OperationalNN
105Outgoing Video call upgrade call: Prop_HexInt32, Call upgrade Guid: Prop_Guid.OperationalNN
106New incoming upgrade video call Prop_HexInt32.OperationalNN
120Invoking AcceptIncoming for VoIP call Prop_HexInt32.OperationalNN
121Invoking RejectIncoming for VoIP call Prop_HexInt32.OperationalNN
122Invoking Hold for VoIP call Prop_HexInt32.OperationalNN
123Invoking Unhold for VoIP call Prop_HexInt32.OperationalNN
124Invoking End for VoIP call Prop_HexInt32.OperationalNN
140Opening audio routing RPC clientOperationalNN
141Opened audio routing RPC clientOperationalNN
142A new SMS Intercept application has been addedOperationalNN
143A new SMS Intercept application has been removedOperationalNN
144A new SMS has arrivedOperationalNN
145A new SMS has been retrieved of length Prop_UInt_1.OperationalNN
150Opening phone call filter clientOperationalNN
151Opened phone call filter clientOperationalNN
152Opening SMS filter clientOperationalNN
153Opened SMS filter clientOperationalNN
200IncomingCallStartOperationalNN
201StartCallStartOperationalNN
202StartCallStopOperationalNN
203EndCallStartOperationalNN
204SetAudioRoutingStartOperationalNN
205SetAudioRoutingStopOperationalNN
206ProcessMuteStateNotificationStartOperationalNN
207ProcessMuteStateNotificationStart207OperationalNN
301Social object is missing UDM property: {Prop_UInt_1}.OperationalNN
304Social object has invalid value for UDM property: {Prop_UInt_1}.OperationalNN
305Saving feed of type=.OperationalNN
307Social Originate Error: {Prop_UnicodeString}.OperationalNN
308Social Cancellation State(Cookie: {Prop_HexInt32}): {Prop_UnicodeString}.OperationalNN
401Saving online picture remote id: [Prop_UnicodeString].OperationalNN
402Saving online video remote id: [Prop_UnicodeString]).OperationalNN
403Saving online album remote id: [Prop_UnicodeString]).OperationalNN
404Bulk saving Prop_UInt_1 albums.OperationalNN
405Bulk saving Prop_UInt_1 media items.OperationalNN
406Done bulk saving albumsOperationalNN
407Done bulk saving media itemsOperationalNN
500PhoneCallAnnotations: Starting location query.OperationalNN
501PhoneCallAnnotations: Completing location query.OperationalNN
502PhoneCallAnnotations: Starting RPC server with endpoint Prop_UnicodeString.OperationalNN
503PhoneCallAnnotations: Stopping RPC serverOperationalNN
600The store for app Prop_Guid was not found.OperationalNN
1000[ChatApis] ChatMessageStoreChangedEventArgs Kind = Prop_UInt_1, Type = …OperationalNN
1001[ChatApis] ChatConversationReaderImpl::ReadBatchWithCountAsync batch count= …OperationalNN
1002[ChatApis] ChatMessageReaderImpl::_ReadBatchImpl batch count= Prop_UInt_1.OperationalNN
1003[ChatApis] ChatMessageStoreImpl::MarkMessageReadAsyncOperationalNN
1004[ChatApis] ChatMessageStoreImpl::RetrySendMessageAsyncOperationalNN
1005[ChatApis] ChatApis::ChatMessageStoreImpl_SendMessageAsyncOperationalNN
1006[ChatApis] ChatMessageManager::GetTransportsAsync Session->EnsureConnected …OperationalNN
1007[ChatApis] ChatMessageManager::GetTransportsAsync Completed RPC call to …OperationalNN
1008[ChatApis] ChatMessageManager::GetTransportsAsync TransportCount=Prop_ULong.OperationalNN
1009[ChatApis] ChatNavigation::_LaunchUriForDefaultChatApp MessagingPackage = …OperationalNN
1010[ChatApis] ChatNavigation::_LaunchUriForDefaultChatApp LaunchStatus = …OperationalNN
1011[ChatApis] …OperationalNN
1012[ChatApis] …OperationalNN
1013[ChatApis] ChatSyncConfigurationImpl::_IsMessageSyncAllowed IsMessageSyncAllowed …OperationalNN
1500ChatMessagesReadBatchWithCountAsync_STARTOperationalNN
1501ChatMessagesReadBatchWithCountAsync_STOPOperationalNN
1502ChatConversationsReadBatchWithCountAsync_STARTOperationalNN
1503ChatConversationsReadBatchWithCountAsync_STOPOperationalNN
1504ChatMessageRead_STARTOperationalNN
1505ChatMessageRead_STOPOperationalNN
1506ChatMessageStoreInitialize_STARTOperationalNN
1507ChatMessageStoreInitialize_STOPOperationalNN
1508ChatConversationReadAsync_STARTOperationalNN
1509ChatConversationReadAsync_STOPOperationalNN
1510ChatConversationThreadingReadAsync_STARTOperationalNN
1511ChatConversationThreadingReadAsync_STOPOperationalNN
1512ChatMessageManagerGetTransportsAsync_STARTOperationalNN
1513ChatMessageManagerGetTransportsAsync_STOPOperationalNN
1514ChatMessageManagerGetTransportAsync_STARTOperationalNN
1515ChatMessageManagerGetTransportAsync_STOPOperationalNN
2000UdmSessionHandleEnsureConnected_STARTOperationalNN
2001UdmSessionHandleEnsureConnected_STOPOperationalNN
100003rd party log: {Prop_Caller} - {Prop_UnicodeString}.OperationalNN

Event ID 1: Error: HRESULT: P1_HResult Location: P2_String Line Number: P3_UInt32.

#
Channel
Operational

Message #

Error: HRESULT: %1 Location: %2 Line Number: %3

Fields #

NameDescription
P1_HResult Int32
P2_String AnsiString
P3_UInt32 UInt32

Event ID 2: Error Propagated: HRESULT: P1_HResult Location: P2_String Line Number: P3_UInt32.

#
Channel
Operational

Message #

Error Propagated: HRESULT: %1 Location: %2 Line Number: %3

Fields #

NameDescription
P1_HResult Int32
P2_String AnsiString
P3_UInt32 UInt32

Event ID 10: Prop_UnicodeString.

#
Channel
Operational

Message #

%1

Fields #

NameDescription
Prop_UnicodeString UnicodeString

Event ID 100: Opening VoIP RPC client

#
Channel
Operational

Event ID 101: Opened VoIP RPC client

#
Channel
Operational

Event ID 102: New incoming VoIP call Prop_HexInt32.

#
Channel
Operational

Message #

New incoming VoIP call %1

Fields #

NameDescription
Prop_HexInt32 UInt32

Event ID 103: New outgoing VoIP call Prop_HexInt32.

#
Channel
Operational

Message #

New outgoing VoIP call %1

Fields #

NameDescription
Prop_HexInt32 UInt32

Event ID 104: Made DSS token Prop_UnicodeString_1 for file Prop_UnicodeString_2.

#
Channel
Operational

Message #

Made DSS token %1 for file %2

Fields #

NameDescription
Prop_UnicodeString_1 UnicodeString
Prop_UnicodeString_2 UnicodeString

Event ID 105: Outgoing Video call upgrade call: Prop_HexInt32, Call upgrade Guid: Prop_Guid.

#
Channel
Operational

Message #

Outgoing Video call upgrade call: %1, Call upgrade Guid: %2

Fields #

NameDescription
Prop_HexInt32 UInt32
Prop_Guid GUID

Event ID 106: New incoming upgrade video call Prop_HexInt32.

#
Channel
Operational

Message #

New incoming upgrade video call %1

Fields #

NameDescription
Prop_HexInt32 UInt32

Event ID 120: Invoking AcceptIncoming for VoIP call Prop_HexInt32.

#
Channel
Operational

Message #

Invoking AcceptIncoming for VoIP call %1

Fields #

NameDescription
Prop_HexInt32 UInt32

Event ID 121: Invoking RejectIncoming for VoIP call Prop_HexInt32.

#
Channel
Operational

Message #

Invoking RejectIncoming for VoIP call %1

Fields #

NameDescription
Prop_HexInt32 UInt32

Event ID 122: Invoking Hold for VoIP call Prop_HexInt32.

#
Channel
Operational

Message #

Invoking Hold for VoIP call %1

Fields #

NameDescription
Prop_HexInt32 UInt32

Event ID 123: Invoking Unhold for VoIP call Prop_HexInt32.

#
Channel
Operational

Message #

Invoking Unhold for VoIP call %1

Fields #

NameDescription
Prop_HexInt32 UInt32

Event ID 124: Invoking End for VoIP call Prop_HexInt32.

#
Channel
Operational

Message #

Invoking End for VoIP call %1

Fields #

NameDescription
Prop_HexInt32 UInt32

Event ID 140: Opening audio routing RPC client

#
Channel
Operational

Event ID 141: Opened audio routing RPC client

#
Channel
Operational

Event ID 142: A new SMS Intercept application has been added

#
Channel
Operational

Event ID 143: A new SMS Intercept application has been removed

#
Channel
Operational

Event ID 144: A new SMS has arrived

#
Channel
Operational

Event ID 145: A new SMS has been retrieved of length Prop_UInt_1.

#
Channel
Operational

Message #

A new SMS has been retrieved of length %1

Fields #

NameDescription
Prop_UInt_1 UInt32

Event ID 150: Opening phone call filter client

#
Channel
Operational

Event ID 151: Opened phone call filter client

#
Channel
Operational

Event ID 152: Opening SMS filter client

#
Channel
Operational

Event ID 153: Opened SMS filter client

#
Channel
Operational

Event ID 200: IncomingCallStart

#
Channel
Operational
Task
IncomingCall
Opcode
Start

Event ID 201: StartCallStart

#
Channel
Operational
Task
StartCall
Opcode
Start

Event ID 202: StartCallStop

#
Channel
Operational
Task
StartCall
Opcode
Stop

Event ID 203: EndCallStart

#
Channel
Operational
Task
EndCall
Opcode
Start

Event ID 204: SetAudioRoutingStart

#
Channel
Operational
Task
SetAudioRouting
Opcode
Start

Event ID 205: SetAudioRoutingStop

#
Channel
Operational
Task
SetAudioRouting
Opcode
Stop

Event ID 206: ProcessMuteStateNotificationStart

#
Channel
Operational
Task
ProcessMuteStateNotification
Opcode
Start

Event ID 207: ProcessMuteStateNotificationStart207

#
Channel
Operational
Task
ProcessMuteStateNotification
Opcode
Start

Event ID 301: Social object is missing UDM property: {Prop_UInt_1}.

#
Channel
Operational

Fields #

NameDescription
Prop_UInt_1

Event ID 304: Social object has invalid value for UDM property: {Prop_UInt_1}.

#
Channel
Operational

Fields #

NameDescription
Prop_UInt_1

Event ID 305: Saving feed of type=.

#
Channel
Operational

Description

Saving feed of type={Prop_Type}; updateMode={Prop_Mode}; operationId={Prop_UInt_1}; itemCount={Prop_UInt_2}.

Message #

Saving feed of type={Prop_Type}; updateMode={Prop_Mode}; operationId={Prop_UInt_1}; itemCount={Prop_UInt_2}

Fields #

NameDescription
Prop_Type
Prop_Mode
Prop_UInt_1
Prop_UInt_2

Event ID 307: Social Originate Error: {Prop_UnicodeString}.

#
Channel
Operational

Fields #

NameDescription
Prop_UnicodeString

Event ID 308: Social Cancellation State(Cookie: {Prop_HexInt32}): {Prop_UnicodeString}.

#
Channel
Operational

Fields #

NameDescription
Prop_HexInt32
Prop_UnicodeString

Event ID 401: Saving online picture remote id: [Prop_UnicodeString].

#
Channel
Operational

Message #

Saving online picture remote id: [%1]

Fields #

NameDescription
Prop_UnicodeString UnicodeString

Event ID 402: Saving online video remote id: [Prop_UnicodeString]).

#
Channel
Operational

Message #

Saving online video remote id: [%1])

Fields #

NameDescription
Prop_UnicodeString UnicodeString

Event ID 403: Saving online album remote id: [Prop_UnicodeString]).

#
Channel
Operational

Message #

Saving online album remote id: [%1])

Fields #

NameDescription
Prop_UnicodeString UnicodeString

Event ID 404: Bulk saving Prop_UInt_1 albums.

#
Channel
Operational

Message #

Bulk saving %1 albums

Fields #

NameDescription
Prop_UInt_1 UInt32

Event ID 405: Bulk saving Prop_UInt_1 media items.

#
Channel
Operational

Message #

Bulk saving %1 media items

Fields #

NameDescription
Prop_UInt_1 UInt32

Event ID 406: Done bulk saving albums

#
Channel
Operational

Event ID 407: Done bulk saving media items

#
Channel
Operational

Event ID 500: PhoneCallAnnotations: Starting location query.

#
Channel
Operational

Description

PhoneCallAnnotations: Starting location query. Phone number: Prop_UnicodeString.

Message #

PhoneCallAnnotations: Starting location query. Phone number: %1

Fields #

NameDescription
Prop_UnicodeString UnicodeString

Event ID 501: PhoneCallAnnotations: Completing location query.

#
Channel
Operational

Description

PhoneCallAnnotations: Completing location query. Location: Prop_UnicodeString.

Message #

PhoneCallAnnotations: Completing location query. Location: %1

Fields #

NameDescription
Prop_UnicodeString UnicodeString

Event ID 502: PhoneCallAnnotations: Starting RPC server with endpoint Prop_UnicodeString.

#
Channel
Operational

Message #

PhoneCallAnnotations: Starting RPC server with endpoint %1

Fields #

NameDescription
Prop_UnicodeString UnicodeString

Event ID 503: PhoneCallAnnotations: Stopping RPC server

#
Channel
Operational

Event ID 600: The store for app Prop_Guid was not found.

#
Channel
Operational

Message #

The store for app %1 was not found

Fields #

NameDescription
Prop_Guid GUID

Event ID 1000: [ChatApis] ChatMessageStoreChangedEventArgs Kind = Prop_UInt_1, Type = Prop_UInt_2.

#
Channel
Operational

Message #

[ChatApis] ChatMessageStoreChangedEventArgs Kind = %1, Type = %2

Fields #

NameDescription
Prop_UInt_1 UInt32
Prop_UInt_2 UInt32

Event ID 1001: [ChatApis] ChatConversationReaderImpl::ReadBatchWithCountAsync batch count= Prop_UInt_1.

#
Channel
Operational

Message #

[ChatApis] ChatConversationReaderImpl::ReadBatchWithCountAsync batch count= %1

Fields #

NameDescription
Prop_UInt_1 UInt32

Event ID 1002: [ChatApis] ChatMessageReaderImpl::_ReadBatchImpl batch count= Prop_UInt_1.

#
Channel
Operational

Message #

[ChatApis] ChatMessageReaderImpl::_ReadBatchImpl batch count= %1

Fields #

NameDescription
Prop_UInt_1 UInt32

Event ID 1003: [ChatApis] ChatMessageStoreImpl::MarkMessageReadAsync

#
Channel
Operational

Event ID 1004: [ChatApis] ChatMessageStoreImpl::RetrySendMessageAsync

#
Channel
Operational

Event ID 1005: [ChatApis] ChatApis::ChatMessageStoreImpl_SendMessageAsync

#
Channel
Operational

Event ID 1006: [ChatApis] ChatMessageManager::GetTransportsAsync Session->EnsureConnected complete.

#
Channel
Operational

Description

[ChatApis] ChatMessageManager::GetTransportsAsync Session->EnsureConnected complete. HRESULT=P1_HResult.

Message #

[ChatApis] ChatMessageManager::GetTransportsAsync Session->EnsureConnected complete. HRESULT=%1

Fields #

NameDescription
P1_HResult Int32

Event ID 1007: [ChatApis] ChatMessageManager::GetTransportsAsync Completed RPC call to UdmSvc_GetChatTransports.

#
Channel
Operational

Description

[ChatApis] ChatMessageManager::GetTransportsAsync Completed RPC call to UdmSvc_GetChatTransports. HRESULT=P1_HResult.

Message #

[ChatApis] ChatMessageManager::GetTransportsAsync Completed RPC call to UdmSvc_GetChatTransports. HRESULT=%1

Fields #

NameDescription
P1_HResult Int32

Event ID 1008: [ChatApis] ChatMessageManager::GetTransportsAsync TransportCount=Prop_ULong.

#
Channel
Operational

Message #

[ChatApis] ChatMessageManager::GetTransportsAsync TransportCount=%1

Fields #

NameDescription
Prop_ULong UInt64

Event ID 1009: [ChatApis] ChatNavigation::_LaunchUriForDefaultChatApp MessagingPackage = Prop_UnicodeString.

#
Channel
Operational

Message #

[ChatApis] ChatNavigation::_LaunchUriForDefaultChatApp MessagingPackage = %1

Fields #

NameDescription
Prop_UnicodeString UnicodeString

Event ID 1010: [ChatApis] ChatNavigation::_LaunchUriForDefaultChatApp LaunchStatus = Prop_UInt_1, Expected = Prop_UInt_2.

#
Channel
Operational

Message #

[ChatApis] ChatNavigation::_LaunchUriForDefaultChatApp LaunchStatus = %1, Expected = %2

Fields #

NameDescription
Prop_UInt_1 UInt32
Prop_UInt_2 UInt32

Event ID 1011: [ChatApis] ChatApis::ChatCapabilitiesManagerStaticImpl_GetCachedCapabilitiesAsync

#
Channel
Operational

Event ID 1012: [ChatApis] ChatApis::ChatCapabilitiesManagerStaticImpl_GetCapabilitiesFromNetworkAsync

#
Channel
Operational

Event ID 1013: [ChatApis] ChatSyncConfigurationImpl::_IsMessageSyncAllowed IsMessageSyncAllowed = Prop_BOOL.

#
Channel
Operational

Message #

[ChatApis] ChatSyncConfigurationImpl::_IsMessageSyncAllowed IsMessageSyncAllowed = %1

Fields #

NameDescription
Prop_BOOL Boolean

Event ID 1500: ChatMessagesReadBatchWithCountAsync_START

#
Channel
Operational
Task
ChatMessagesReadBatchWithCountAsync_START
Opcode
Start

Event ID 1501: ChatMessagesReadBatchWithCountAsync_STOP

#
Channel
Operational
Task
ChatMessagesReadBatchWithCountAsync_STOP
Opcode
Stop

Event ID 1502: ChatConversationsReadBatchWithCountAsync_START

#
Channel
Operational
Task
ChatConversationsReadBatchWithCountAsync_START
Opcode
Start

Event ID 1503: ChatConversationsReadBatchWithCountAsync_STOP

#
Channel
Operational
Task
ChatConversationsReadBatchWithCountAsync_STOP
Opcode
Stop

Event ID 1504: ChatMessageRead_START

#
Channel
Operational
Task
ChatMessageRead_START
Opcode
Start

Event ID 1505: ChatMessageRead_STOP

#
Channel
Operational
Task
ChatMessageRead_STOP
Opcode
Stop

Event ID 1506: ChatMessageStoreInitialize_START

#
Channel
Operational
Task
ChatMessageStoreInitialize_START
Opcode
Start

Event ID 1507: ChatMessageStoreInitialize_STOP

#
Channel
Operational
Task
ChatMessageStoreInitialize_STOP
Opcode
Stop

Event ID 1508: ChatConversationReadAsync_START

#
Channel
Operational
Task
ChatConversationReadAsync_START
Opcode
Start

Event ID 1509: ChatConversationReadAsync_STOP

#
Channel
Operational
Task
ChatConversationReadAsync_STOP
Opcode
Stop

Event ID 1510: ChatConversationThreadingReadAsync_START

#
Channel
Operational
Task
ChatConversationThreadingReadAsync_START
Opcode
Start

Event ID 1511: ChatConversationThreadingReadAsync_STOP

#
Channel
Operational
Task
ChatConversationThreadingReadAsync_STOP
Opcode
Stop

Event ID 1512: ChatMessageManagerGetTransportsAsync_START

#
Channel
Operational
Task
ChatMessageManagerGetTransportsAsync_START
Opcode
Start

Event ID 1513: ChatMessageManagerGetTransportsAsync_STOP

#
Channel
Operational
Task
ChatMessageManagerGetTransportsAsync_STOP
Opcode
Stop

Event ID 1514: ChatMessageManagerGetTransportAsync_START

#
Channel
Operational
Task
ChatMessageManagerGetTransportAsync_START
Opcode
Start

Event ID 1515: ChatMessageManagerGetTransportAsync_STOP

#
Channel
Operational
Task
ChatMessageManagerGetTransportAsync_STOP
Opcode
Stop

Event ID 2000: UdmSessionHandleEnsureConnected_START

#
Channel
Operational
Task
UdmSessionHandleEnsureConnected_START
Opcode
Start

Event ID 2001: UdmSessionHandleEnsureConnected_STOP

#
Channel
Operational
Task
UdmSessionHandleEnsureConnected_STOP
Opcode
Stop

Event ID 10000: 3rd party log: {Prop_Caller} - {Prop_UnicodeString}.

#
Channel
Operational

Fields #

NameDescription
Prop_Caller
Prop_UnicodeString

Provenance

ETW provider GUID b9b2de3c-3fbd-4f42-8ff7-33c3bad35fd4

Defined in AppointmentApis.dll, which carries the event manifest.