Microsoft-Windows-WPD-CompositeClassDriver

35 events across 2 channels

Event	Title	Channel	Sample
100	Transport Arrival Begin: TransportSymbolicLink.	Analytic	N
101	Transport Arrival End: TransportSymbolicLink.	Analytic	N
102	Transport Departure Begin: TransportSymbolicLink.	Analytic	N
103	Transport Departure End: TransportSymbolicLink.	Analytic	N
104	OnCreateFile Begin: ReferenceString.	Analytic	N
105	OnCreateFile End: ReferenceString.	Analytic	N
106	DeviceIoControl Begin	Analytic	N
107	DeviceIoControl End	Analytic	N
108	Transport Look-Up Begin	Analytic	N
109	Transport Look-Up End	Analytic	N
110	Custom Event Relay Begin	Analytic	N
111	Custom Event Relay End	Analytic	N
112	Commit Transport Interface States Begin	Analytic	N
113	Commit Transport Interface States End	Analytic	N
200	Transport Arrival: TransportSymbolicLink.	Operational	N
201	Transport Departure: TransportSymbolicLink.	Operational	N
202	Enabled Interface GUID: InterfaceGUID, ReferenceString: ReferenceString.	Operational	N
203	Disabled Interface GUID: InterfaceGUID, ReferenceString: ReferenceString.	Operational	N
300	No Multi-Transport support with the current version of the User Mode Driver …	Operational	N
301	Unable to create remote interface for transport: TransportSymbolicLink.	Operational	N
302	Unable to open IoTarget for transport: TransportSymbolicLink.	Operational	N
303	Transport driver returned an incorrect MULTI_TRANSPORT_BANDWIDTH structure.	Operational	N
304	Transport driver returned an incorrect MULTI_TRANSPORT_INTERFACE_STATE …	Operational	N
305	Transport driver returned an incorrect MULTI_TRANSPORT_HDR structure.	Operational	N
306	MULTI_TRANSPORT_INTERFACE_STATE structure too short for provided reference …	Operational	N
307	Reference string not expected for specified action …	Operational	N
308	Unexpected function for MULTI_TRANSPORT_INTERFACE_STATE: Value Must be one of: …	Operational	N
309	Unexpected action for MULTI_TRANSPORT_INTERFACE_STATE: Value Must be one of: …	Operational	N
310	Unexpected HRESULT for IOCTL_TRANSPORT_REQUEST initiation: Value Interface state …	Operational	N
311	Unexpected HRESULT for IOCTL_TRANSPORT_REQUEST completion: Value Interface state …	Operational	N
312	Transport driver returned an incorrect MULTI_TRANSPORT_STATE structure.	Operational	N
313	Transport driver returned an incorrect MULTI_TRANSPORT_FRIENDLYNAME structure.	Operational	N
314	MULTI_TRANSPORT_FRIENDLYNAME structure too short for provided string, or string …	Operational	N
315	MULTI_TRANSPORT_FRIENDLYNAME structure must provide a NULL-terminated string	Operational	N
316	Could not extract properties for interface state request.	Operational	N

Event ID 100: Transport Arrival Begin: TransportSymbolicLink.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Analytic
Task: DriverPerformance
Opcode: Start

Description

Transport Arrival Begin: TransportSymbolicLink.

Message #

Transport Arrival Begin: %1

Fields #

Name	Description
`TransportSymbolicLink` UnicodeString

Event ID 101: Transport Arrival End: TransportSymbolicLink.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Analytic
Task: DriverPerformance
Opcode: Stop

Description

Transport Arrival End: TransportSymbolicLink.

Message #

Transport Arrival End: %1

Fields #

Name	Description
`TransportSymbolicLink` UnicodeString

Event ID 102: Transport Departure Begin: TransportSymbolicLink.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Analytic
Task: DriverPerformance
Opcode: Start

Description

Transport Departure Begin: TransportSymbolicLink.

Message #

Transport Departure Begin: %1

Fields #

Name	Description
`TransportSymbolicLink` UnicodeString

Event ID 103: Transport Departure End: TransportSymbolicLink.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Analytic
Task: DriverPerformance
Opcode: Stop

Description

Transport Departure End: TransportSymbolicLink.

Message #

Transport Departure End: %1

Fields #

Name	Description
`TransportSymbolicLink` UnicodeString

Event ID 104: OnCreateFile Begin: ReferenceString.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Analytic
Task: DriverPerformance
Opcode: Start

Description

OnCreateFile Begin: ReferenceString.

Message #

OnCreateFile Begin: %1

Fields #

Name	Description
`ReferenceString` UnicodeString

Event ID 105: OnCreateFile End: ReferenceString.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Analytic
Task: DriverPerformance
Opcode: Stop

Description

OnCreateFile End: ReferenceString.

Message #

OnCreateFile End: %1

Fields #

Name	Description
`ReferenceString` UnicodeString

Event ID 106: DeviceIoControl Begin

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Analytic
Task: DriverPerformance
Opcode: Start

Description

DeviceIoControl Begin.

Message #

DeviceIoControl Begin

Event ID 107: DeviceIoControl End

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Analytic
Task: DriverPerformance
Opcode: Stop

Description

DeviceIoControl End.

Message #

DeviceIoControl End

Event ID 108: Transport Look-Up Begin

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Analytic
Task: DriverPerformance
Opcode: Start

Description

Transport Look-Up Begin.

Message #

Transport Look-Up Begin

Event ID 109: Transport Look-Up End

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Analytic
Task: DriverPerformance
Opcode: Stop

Description

Transport Look-Up End.

Message #

Transport Look-Up End

Event ID 110: Custom Event Relay Begin

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Analytic
Task: DriverPerformance
Opcode: Start

Description

Custom Event Relay Begin.

Message #

Custom Event Relay Begin

Event ID 111: Custom Event Relay End

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Analytic
Task: DriverPerformance
Opcode: Stop

Description

Custom Event Relay End.

Message #

Custom Event Relay End

Event ID 112: Commit Transport Interface States Begin

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Analytic
Task: DriverPerformance
Opcode: Start

Description

Commit Transport Interface States Begin.

Message #

Commit Transport Interface States Begin

Event ID 113: Commit Transport Interface States End

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Analytic
Task: DriverPerformance
Opcode: Stop

Description

Commit Transport Interface States End.

Message #

Commit Transport Interface States End

Event ID 200: Transport Arrival: TransportSymbolicLink.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: TransportManagement

Description

Transport Arrival: TransportSymbolicLink.

Message #

Transport Arrival: %1

Fields #

Name	Description
`TransportSymbolicLink` UnicodeString

Event ID 201: Transport Departure: TransportSymbolicLink.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: TransportManagement

Description

Transport Departure: TransportSymbolicLink.

Message #

Transport Departure: %1

Fields #

Name	Description
`TransportSymbolicLink` UnicodeString

Event ID 202: Enabled Interface GUID: InterfaceGUID, ReferenceString: ReferenceString.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: TransportManagement

Description

Enabled Interface GUID: InterfaceGUID, ReferenceString: ReferenceString.

Message #

Enabled Interface GUID: %1, ReferenceString: %2

Fields #

Name	Description
`InterfaceGUID` GUID
`ReferenceString` UnicodeString

Event ID 203: Disabled Interface GUID: InterfaceGUID, ReferenceString: ReferenceString.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: TransportManagement

Description

Disabled Interface GUID: InterfaceGUID, ReferenceString: ReferenceString.

Message #

Disabled Interface GUID: %1, ReferenceString: %2

Fields #

Name	Description
`InterfaceGUID` GUID
`ReferenceString` UnicodeString

Event ID 300: No Multi-Transport support with the current version of the User Mode Driver Framework

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: DriverFailure

Description

No Multi-Transport support with the current version of the User Mode Driver Framework.

Message #

No Multi-Transport support with the current version of the User Mode Driver Framework

Event ID 301: Unable to create remote interface for transport: TransportSymbolicLink.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: DriverFailure

Description

Unable to create remote interface for transport: TransportSymbolicLink.

Message #

Unable to create remote interface for transport: %1

Fields #

Name	Description
`TransportSymbolicLink` UnicodeString

Event ID 302: Unable to open IoTarget for transport: TransportSymbolicLink.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: DriverFailure

Description

Unable to open IoTarget for transport: TransportSymbolicLink.

Message #

Unable to open IoTarget for transport: %1

Fields #

Name	Description
`TransportSymbolicLink` UnicodeString

Event ID 303: Transport driver returned an incorrect MULTI_TRANSPORT_BANDWIDTH structure.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: TransportManagement

Description

Transport driver returned an incorrect MULTI_TRANSPORT_BANDWIDTH structure.

Message #

Transport driver returned an incorrect MULTI_TRANSPORT_BANDWIDTH structure.
Expected Size: %1, Actual Size: %2

Fields #

Name	Description
`ExpectedSize` UInt64
`ActualSize` UInt64

Event ID 304: Transport driver returned an incorrect MULTI_TRANSPORT_INTERFACE_STATE structure.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: TransportManagement

Description

Transport driver returned an incorrect MULTI_TRANSPORT_INTERFACE_STATE structure.

Message #

Transport driver returned an incorrect MULTI_TRANSPORT_INTERFACE_STATE structure.
Expected Size: >= %1, Actual Size: %2

Fields #

Name	Description
`ExpectedSize` UInt64
`ActualSize` UInt64

Event ID 305: Transport driver returned an incorrect MULTI_TRANSPORT_HDR structure.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: TransportManagement

Description

Transport driver returned an incorrect MULTI_TRANSPORT_HDR structure.

Message #

Transport driver returned an incorrect MULTI_TRANSPORT_HDR structure.
Expected Size: >= %1, Actual Size: %2

Fields #

Name	Description
`ExpectedSize` UInt64
`ActualSize` UInt64

Event ID 306: MULTI_TRANSPORT_INTERFACE_STATE structure too short for provided reference string, or reference string not NULL-terminated

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: TransportManagement

Description

MULTI_TRANSPORT_INTERFACE_STATE structure too short for provided reference string, or reference string not NULL-terminated.

Message #

MULTI_TRANSPORT_INTERFACE_STATE structure too short for provided reference string, or reference string not NULL-terminated

Event ID 307: Reference string not expected for specified action (MULTI_TRANSPORT_INTERFACE_STATE)

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: TransportManagement

Description

Reference string not expected for specified action (MULTI_TRANSPORT_INTERFACE_STATE).

Message #

Reference string not expected for specified action (MULTI_TRANSPORT_INTERFACE_STATE)

Event ID 308: Unexpected function for MULTI_TRANSPORT_INTERFACE_STATE: Value Must be one of: FUNCTION_MULTI_TRANSPORT_BANDWIDTH FUNCTION_MULTI_TRANSPORT_INTERFACE_S...

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: TransportManagement

Description

Unexpected function for MULTI_TRANSPORT_INTERFACE_STATE: Value.

Message #

Unexpected function for MULTI_TRANSPORT_INTERFACE_STATE: %1

Must be one of:
  FUNCTION_MULTI_TRANSPORT_BANDWIDTH
  FUNCTION_MULTI_TRANSPORT_INTERFACE_STATE

Fields #

Name	Description
`Value` UInt32

Event ID 309: Unexpected action for MULTI_TRANSPORT_INTERFACE_STATE: Value Must be one of: ACTION_MULTI_TRANSPORT_ENABLE ACTION_MULTI_TRANSPORT_DISABLE ACTION_MULTI...

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: TransportManagement

Description

Unexpected action for MULTI_TRANSPORT_INTERFACE_STATE: Value.

Message #

Unexpected action for MULTI_TRANSPORT_INTERFACE_STATE: %1

Must be one of:
  ACTION_MULTI_TRANSPORT_ENABLE
  ACTION_MULTI_TRANSPORT_DISABLE
  ACTION_MULTI_TRANSPORT_ENDOFSET
  ACTION_MULTI_TRANSPORT_DISABLEALL

Fields #

Name	Description
`Value` UInt32

Event ID 310: Unexpected HRESULT for IOCTL_TRANSPORT_REQUEST initiation: Value Interface state discovery has stopped.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: TransportManagement

Description

Unexpected HRESULT for IOCTL_TRANSPORT_REQUEST initiation: Value.

Message #

Unexpected HRESULT for IOCTL_TRANSPORT_REQUEST initiation: %1
Interface state discovery has stopped.

Fields #

Name	Description
`Value` UInt32

Event ID 311: Unexpected HRESULT for IOCTL_TRANSPORT_REQUEST completion: Value Interface state discovery has stopped.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: TransportManagement

Description

Unexpected HRESULT for IOCTL_TRANSPORT_REQUEST completion: Value.

Message #

Unexpected HRESULT for IOCTL_TRANSPORT_REQUEST completion: %1
Interface state discovery has stopped.

Fields #

Name	Description
`Value` UInt32

Event ID 312: Transport driver returned an incorrect MULTI_TRANSPORT_STATE structure.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: TransportManagement

Description

Transport driver returned an incorrect MULTI_TRANSPORT_STATE structure.

Message #

Transport driver returned an incorrect MULTI_TRANSPORT_STATE structure.
Expected Size: >= %1, Actual Size: %2

Fields #

Name	Description
`ExpectedSize` UInt64
`ActualSize` UInt64

Event ID 313: Transport driver returned an incorrect MULTI_TRANSPORT_FRIENDLYNAME structure.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: TransportManagement

Description

Transport driver returned an incorrect MULTI_TRANSPORT_FRIENDLYNAME structure.

Message #

Transport driver returned an incorrect MULTI_TRANSPORT_FRIENDLYNAME structure.
Expected Size: >= %1, Actual Size: %2

Fields #

Name	Description
`ExpectedSize` UInt64
`ActualSize` UInt64

Event ID 314: MULTI_TRANSPORT_FRIENDLYNAME structure too short for provided string, or string not NULL-terminated

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: TransportManagement

Description

MULTI_TRANSPORT_FRIENDLYNAME structure too short for provided string, or string not NULL-terminated.

Message #

MULTI_TRANSPORT_FRIENDLYNAME structure too short for provided string, or string not NULL-terminated

Event ID 315: MULTI_TRANSPORT_FRIENDLYNAME structure must provide a NULL-terminated string

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: TransportManagement

Description

MULTI_TRANSPORT_FRIENDLYNAME structure must provide a NULL-terminated string.

Message #

MULTI_TRANSPORT_FRIENDLYNAME structure must provide a NULL-terminated string

Event ID 316: Could not extract properties for interface state request.

Provider: Microsoft-Windows-WPD-CompositeClassDriver
Channel: Operational
Task: TransportManagement

Description

Could not extract properties for interface state request. The data may be invalid.

Message #

Could not extract properties for interface state request. The data may be invalid.

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 355c44fe-0c8e-4bf8-be28-8bc7b5a42720

Defined in wpd_ci.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)