sqlserver

1 events across 1 channel

Event	Title	Channel	Sample
0	process_login_finish	ETW Trace	N

Event ID 0: process_login_finish

Provider: sqlserver
Channel: ETW Trace

Message #

This event is generated when server is done processing a login (success or failure).

Fields #

Name	Description
`FragmentId` UInt32
`RemainingLength` UInt32
`ActivityId` Object
`SequenceNumber` UInt32
`state_desc` UInt32
`external_governance_policy_authorization` UInt32
`is_success` SInt8
`is_external_authentication_only` SInt8
`tds_version` UInt32
`total_time_ms` UInt32
`enqueue_time_ms` UInt32
`netwrite_time_ms` UInt32
`netread_time_ms` UInt32
`ssl_time_ms` UInt32
`sspi_time_ms` UInt32
`login_time_ms` UInt32
`logon_triggers_time_ms` UInt32
`find_login_ms` UInt32
`exec_classifier_ms` UInt32
`session_recover_ms` UInt32
`post_exec_classifier_ms` UInt32
`ssl_read_time_ms` UInt32
`ssl_write_time_ms` UInt32
`ssl_secure_call_time_ms` UInt32
`ssl_enqueue_time_ms` UInt32
`ssl_protocol` UInt32
`ssl_hash` UInt32
`ssl_cipher` UInt32
`sspi_read_time_ms` UInt32
`sspi_write_time_ms` UInt32
`sspi_secure_call_time_ms` UInt32
`sspi_enqueue_time_ms` UInt32
`fedauth_token_process_time_ms` UInt32
`fedauth_fetch_signingkey_refresh_time_ms` UInt32
`fedauth_jwt_token_parsing_time_ms` UInt32
`fedauth_signature_validation_time_ms` UInt32
`fedauth_context_build_time_ms` UInt32
`fedauth_group_expansion_time_ms` UInt32
`fedauth_token_wait_time_ms` UInt32
`database_firewall_rules_time_ms` UInt32
`use_db_database_firewall_rules_time_ms` UInt32
`dosguard_check_time_ms` UInt32
`xodbc_authentication_time_ms` UInt32
`contained_authentication_time_ms` UInt32
`peer_activity_seq` UInt32
`peer_port` UInt16
`fedauth_library_type` SInt8
`fedauth_adal_workflow` SInt8
`is_duplicated` SInt8
`is_contained_user` SInt8
`provider_type` UInt8
`is_user_error` SInt8
`error` SInt32
`state` SInt32
`concurrent_logins` SInt32
`driver_version` UInt32
`driver_version_minor` UInt32
`session_recovery_format_length` UInt32
`session_recovery_is_enabled` SInt8
`session_recovery_is_recovered` SInt8
`is_mars` SInt8
`is_relogin` SInt8
`login_flags` UInt32
`client_pid` UInt32
`is_replay_connection` SInt8
`xodbc_authentication_type` SInt8
`used_login_thread_pool` SInt8
`is_mfa` SInt8
`is_vnet_address` SInt8
`is_failoverpartner_token_returned` SInt8
`vnet_region_id` UInt32
`vnet_gre_key` UInt32
`is_peer_activity_id_null` SInt8
`is_vnet_private_access_address` SInt8
`is_nsp_claim_present` SInt8
`vnet_subnet_id` UInt32
`vnet_link_identifier` SInt32
`spid` SInt32
`sql_client_dns_caching_status` SInt16
`force_refresh_status` SInt16
`connection_id` Object
`connection_peer_id` Object
`peer_activity_id` Object
`server_name` String
`instance_name` String
`logical_server_name` String
`database_name` String
`driver_name` String
`partition_id` Object
`peer_address` String
`vnet_peer_address` String
`vnet_dest_peer_address` String
`login_correlation_hash` Object
`application_name` String
`control_ring_address` String
`message` String
`sni_server_name` String
`extra_info` String

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 03fda7d0-91ba-45f8-9875-8b6dd0b8e9f2

Observed on:

WS2022-20348.4893, schema read from the WMI MOF class, captured 2026-06-02
MOF class: XeSqlPkg

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

sqlserver

Event ID 0: process_login_finish

Message #

Fields #

Provenance

Keyboard shortcuts

Search operators