detection.wiki

Microsoft-Windows-Volume

EventTitleChannelSampleRule
1001Operation started.DiagnosticNN
1002Operation completed.DiagnosticNN

Event ID 1001: Operation started.

#
Channel
Diagnostic

Event ID 1002: Operation completed.

#
Channel
Diagnostic