Microsoft-Windows-VAN

Event	Title	Channel	Sample	Rule
8001	InitStart	Diagnostic	N	N
8002	InitStop	Diagnostic	N	N
8005	ShowFlyoutFromTrayStart	Diagnostic	N	N
8006	ShowFlyoutFromTrayStop	Diagnostic	N	N
8007	ShowCFEStart	Diagnostic	N	N
8008	ShowCFEStop	Diagnostic	N	N
8009	DisconnectStart	Diagnostic	N	N
8010	DisconnectStop	Diagnostic	N	N
8012	CFE Connection Flow Completed	Diagnostic	N	N
8013	Network Status set to Limited	Diagnostic	N	N
8014	Network Status set to Connected	Diagnostic	N	N
8015	LoadPreCFEStart	Diagnostic	N	N
8016	LoadPreCFEStop	Diagnostic	N	N
8017	ExpandNetworkStart	Diagnostic	N	N
8018	ExpandNetworkStop	Diagnostic	N	N
8019	DisplayContextMenuStart	Diagnostic	N	N
8020	DisplayContextMenuStop	Diagnostic	N	N

Event ID 8001: InitStart

Channel: Diagnostic
Task: Init
Opcode: Start

Event ID 8002: InitStop

Channel: Diagnostic
Task: Init
Opcode: Stop

Event ID 8005: ShowFlyoutFromTrayStart

Channel: Diagnostic
Task: ShowFlyoutFromTray
Opcode: Start

Event ID 8006: ShowFlyoutFromTrayStop

Channel: Diagnostic
Task: ShowFlyoutFromTray
Opcode: Stop

Event ID 8007: ShowCFEStart

Channel: Diagnostic
Task: ShowCFE
Opcode: Start

Event ID 8008: ShowCFEStop

Channel: Diagnostic
Task: ShowCFE
Opcode: Stop

Event ID 8009: DisconnectStart

Channel: Diagnostic
Task: Disconnect
Opcode: Start

Event ID 8010: DisconnectStop

Channel: Diagnostic
Task: Disconnect
Opcode: Stop

Event ID 8012: CFE Connection Flow Completed

Channel: Diagnostic
Task: CFEConnectFlowFinished
Opcode: Info

Event ID 8013: Network Status set to Limited

Channel: Diagnostic
Task: NetworkStatus_Limited
Opcode: Info

Event ID 8014: Network Status set to Connected

Channel: Diagnostic
Task: NetworkStatus_Connected
Opcode: Info

Event ID 8015: LoadPreCFEStart

Channel: Diagnostic
Task: LoadPreCFE
Opcode: Start

Event ID 8016: LoadPreCFEStop

Channel: Diagnostic
Task: LoadPreCFE
Opcode: Stop

Event ID 8017: ExpandNetworkStart

Channel: Diagnostic
Task: ExpandNetwork
Opcode: Start

Event ID 8018: ExpandNetworkStop

Channel: Diagnostic
Task: ExpandNetwork
Opcode: Stop

Event ID 8019: DisplayContextMenuStart

Channel: Diagnostic
Task: DisplayContextMenu
Opcode: Start

Event ID 8020: DisplayContextMenuStop

Channel: Diagnostic
Task: DisplayContextMenu
Opcode: Stop

Provenance

ETW provider GUID 01578f96-c270-4602-ade0-578d9c29fc0c

Defined in van.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB