admin/jonny-jhnson-JonMon-Lite
1
0
Fork 0
mirror of https://github.com/jonny-jhnson/JonMon-Lite synced 2026-06-21 13:54:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
54de687a9733c3ed3696215cc0c162e658cb10f8
jonny-jhnson-JonMon-Lite/JonMon-Lite/DefaultBinaries/JonMon-Lite.xml
T
Jonathan Johnson 54de687a97 Initial Commit
2025-06-02 22:31:59 -04:00

1303 lines
37 KiB
XML
Raw Blame History

<?xml version="1.0" encoding="UTF-16"?>
<DataCollectorSet>
<SubdirectoryFormat>3</SubdirectoryFormat>
<SegmentMaxSize>25</SegmentMaxSize>
<Security>O:BAD:AI(A;;FA;;;SY)(A;;FA;;;BA)(A;;0x1200a9;;;LU)(A;;0x1301ff;;;S-1-5-80-2661322625-712705077-2999183737-3043590567-590698655)(A;ID;0x1f019f;;;BA)(A;ID;0x1f019f;;;SY)(A;ID;FR;;;AU)(A;ID;FR;;;LS)(A;ID;FR;;;NS)(A;ID;FA;;;BA)</Security>
<TraceDataCollector>
<DataCollectorType>1</DataCollectorType>
<Name>JonMon-Lite</Name>
<FileName>JonMon-Lite</FileName>
<FileNameFormat>0</FileNameFormat>
<FileNameFormatPattern>
</FileNameFormatPattern>
<LogAppend>0</LogAppend>
<LogCircular>-1</LogCircular>
<LogOverwrite>0</LogOverwrite>
<Guid>{00000000-0000-0000-0000-000000000000}</Guid>
<BufferSize>8</BufferSize>
<BuffersLost>0</BuffersLost>
<BuffersWritten>0</BuffersWritten>
<ClockType>2</ClockType>
<EventsLost>0</EventsLost>
<ExtendedModes>0</ExtendedModes>
<FlushTimer>2</FlushTimer>
<FreeBuffers>0</FreeBuffers>
<MaximumBuffers>0</MaximumBuffers>
<MinimumBuffers>0</MinimumBuffers>
<NumberOfBuffers>0</NumberOfBuffers>
<PreallocateFile>0</PreallocateFile>
<ProcessMode>0</ProcessMode>
<RealTimeBuffersLost>0</RealTimeBuffersLost>
<SessionName>JonMon-Lite</SessionName>
<SessionThreadId>0</SessionThreadId>
<StreamMode>1</StreamMode>
<TraceDataProvider>
<DisplayName>Microsoft-Windows-RPC</DisplayName>
<FilterEnabled>0</FilterEnabled>
<FilterType>0</FilterType>
<Level>
<Description>Events up to this level are enabled</Description>
<ValueMapType>1</ValueMapType>
<Value>0</Value>
<ValueMapItem>
<Key>win:Error</Key>
<Description>Error</Description>
<Enabled>0</Enabled>
<Value>0x2</Value>
</ValueMapItem>
<ValueMapItem>
<Key>win:Informational</Key>
<Description>Information</Description>
<Enabled>0</Enabled>
<Value>0x4</Value>
</ValueMapItem>
<ValueMapItem>
<Key>win:Verbose</Key>
<Description>Verbose</Description>
<Enabled>0</Enabled>
<Value>0x5</Value>
</ValueMapItem>
<ValueMapItem>
<Key>
</Key>
<Description>
</Description>
<Enabled>-1</Enabled>
<Value>0x0</Value>
</ValueMapItem>
</Level>
<KeywordsAny>
<Description>Events with any of these keywords are enabled</Description>
<ValueMapType>2</ValueMapType>
<Value>0x0</Value>
<ValueMapItem>
<Key>Microsoft-Windows-RPC/EEInfo</Key>
<Description>EEInfo</Description>
<Enabled>0</Enabled>
<Value>0x8000000000000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>Microsoft-Windows-RPC/Debug</Key>
<Description>Debug</Description>
<Enabled>0</Enabled>
<Value>0x4000000000000000</Value>
</ValueMapItem>
</KeywordsAny>
<KeywordsAll>
<Description>Events with all of these keywords are enabled</Description>
<ValueMapType>2</ValueMapType>
<Value>0x0</Value>
<ValueMapItem>
<Key>Microsoft-Windows-RPC/EEInfo</Key>
<Description>EEInfo</Description>
<Enabled>0</Enabled>
<Value>0x8000000000000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>Microsoft-Windows-RPC/Debug</Key>
<Description>Debug</Description>
<Enabled>0</Enabled>
<Value>0x4000000000000000</Value>
</ValueMapItem>
</KeywordsAll>
<Properties>
<Description>These additional data fields will be collected with each event</Description>
<ValueMapType>2</ValueMapType>
<Value>0</Value>
<ValueMapItem>
<Key>sid</Key>
<Description>Security Identifier</Description>
<Enabled>0</Enabled>
<Value>0x1</Value>
</ValueMapItem>
<ValueMapItem>
<Key>sessionid</Key>
<Description>Session Identifier</Description>
<Enabled>0</Enabled>
<Value>0x2</Value>
</ValueMapItem>
</Properties>
<Guid>{6AD52B32-D609-4BE9-AE07-CE8DAE937E39}</Guid>
</TraceDataProvider>
<TraceDataProvider>
<DisplayName>Microsoft-Antimalware-Scan-Interface</DisplayName>
<FilterEnabled>0</FilterEnabled>
<FilterType>0</FilterType>
<Level>
<Description>Events up to this level are enabled</Description>
<ValueMapType>1</ValueMapType>
<Value>0</Value>
<ValueMapItem>
<Key>win:Informational</Key>
<Description>Information</Description>
<Enabled>0</Enabled>
<Value>0x4</Value>
</ValueMapItem>
<ValueMapItem>
<Key>
</Key>
<Description>
</Description>
<Enabled>-1</Enabled>
<Value>0x0</Value>
</ValueMapItem>
</Level>
<KeywordsAny>
<Description>Events with any of these keywords are enabled</Description>
<ValueMapType>2</ValueMapType>
<Value>0x0</Value>
<ValueMapItem>
<Key>Event1</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x1</Value>
</ValueMapItem>
<ValueMapItem>
<Key>AMSI/Debug</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x8000000000000000</Value>
</ValueMapItem>
</KeywordsAny>
<KeywordsAll>
<Description>Events with all of these keywords are enabled</Description>
<ValueMapType>2</ValueMapType>
<Value>0x0</Value>
<ValueMapItem>
<Key>Event1</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x1</Value>
</ValueMapItem>
<ValueMapItem>
<Key>AMSI/Debug</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x8000000000000000</Value>
</ValueMapItem>
</KeywordsAll>
<Properties>
<Description>These additional data fields will be collected with each event</Description>
<ValueMapType>2</ValueMapType>
<Value>0</Value>
<ValueMapItem>
<Key>sid</Key>
<Description>Security Identifier</Description>
<Enabled>0</Enabled>
<Value>0x1</Value>
</ValueMapItem>
<ValueMapItem>
<Key>sessionid</Key>
<Description>Session Identifier</Description>
<Enabled>0</Enabled>
<Value>0x2</Value>
</ValueMapItem>
</Properties>
<Guid>{2A576B87-09A7-520E-C21A-4942F0271D67}</Guid>
</TraceDataProvider>
<TraceDataProvider>
<DisplayName>Microsoft-Windows-DotNETRuntime</DisplayName>
<FilterEnabled>0</FilterEnabled>
<FilterType>0</FilterType>
<Level>
<Description>Events up to this level are enabled</Description>
<ValueMapType>1</ValueMapType>
<Value>0</Value>
<ValueMapItem>
<Key>win:LogAlways</Key>
<Description>Log Always</Description>
<Enabled>-1</Enabled>
<Value>0x0</Value>
</ValueMapItem>
<ValueMapItem>
<Key>win:Error</Key>
<Description>Error</Description>
<Enabled>0</Enabled>
<Value>0x2</Value>
</ValueMapItem>
<ValueMapItem>
<Key>win:Informational</Key>
<Description>Information</Description>
<Enabled>0</Enabled>
<Value>0x4</Value>
</ValueMapItem>
<ValueMapItem>
<Key>win:Verbose</Key>
<Description>Verbose</Description>
<Enabled>0</Enabled>
<Value>0x5</Value>
</ValueMapItem>
</Level>
<KeywordsAny>
<Description>Events with any of these keywords are enabled</Description>
<ValueMapType>2</ValueMapType>
<Value>0x8</Value>
<ValueMapItem>
<Key>GCKeyword</Key>
<Description>GC</Description>
<Enabled>0</Enabled>
<Value>0x1</Value>
</ValueMapItem>
<ValueMapItem>
<Key>GCHandleKeyword</Key>
<Description>GCHandle</Description>
<Enabled>0</Enabled>
<Value>0x2</Value>
</ValueMapItem>
<ValueMapItem>
<Key>FusionKeyword</Key>
<Description>Binder</Description>
<Enabled>0</Enabled>
<Value>0x4</Value>
</ValueMapItem>
<ValueMapItem>
<Key>LoaderKeyword</Key>
<Description>Loader</Description>
<Enabled>-1</Enabled>
<Value>0x8</Value>
</ValueMapItem>
<ValueMapItem>
<Key>JitKeyword</Key>
<Description>Jit</Description>
<Enabled>0</Enabled>
<Value>0x10</Value>
</ValueMapItem>
<ValueMapItem>
<Key>NGenKeyword</Key>
<Description>NGen</Description>
<Enabled>0</Enabled>
<Value>0x20</Value>
</ValueMapItem>
<ValueMapItem>
<Key>StartEnumerationKeyword</Key>
<Description>StartEnumeration</Description>
<Enabled>0</Enabled>
<Value>0x40</Value>
</ValueMapItem>
<ValueMapItem>
<Key>EndEnumerationKeyword</Key>
<Description>StopEnumeration</Description>
<Enabled>0</Enabled>
<Value>0x80</Value>
</ValueMapItem>
<ValueMapItem>
<Key>SecurityKeyword</Key>
<Description>Security</Description>
<Enabled>0</Enabled>
<Value>0x400</Value>
</ValueMapItem>
<ValueMapItem>
<Key>AppDomainResourceManagementKeyword</Key>
<Description>AppDomainResourceManagement</Description>
<Enabled>0</Enabled>
<Value>0x800</Value>
</ValueMapItem>
<ValueMapItem>
<Key>JitTracingKeyword</Key>
<Description>JitTracing</Description>
<Enabled>0</Enabled>
<Value>0x1000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>InteropKeyword</Key>
<Description>Interop</Description>
<Enabled>0</Enabled>
<Value>0x2000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ContentionKeyword</Key>
<Description>Contention</Description>
<Enabled>0</Enabled>
<Value>0x4000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ExceptionKeyword</Key>
<Description>Exception</Description>
<Enabled>0</Enabled>
<Value>0x8000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ThreadingKeyword</Key>
<Description>Threading</Description>
<Enabled>0</Enabled>
<Value>0x10000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>JittedMethodILToNativeMapKeyword</Key>
<Description>JittedMethodILToNativeMap</Description>
<Enabled>0</Enabled>
<Value>0x20000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>OverrideAndSuppressNGenEventsKeyword</Key>
<Description>OverrideAndSuppressNGenEvents</Description>
<Enabled>0</Enabled>
<Value>0x40000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>TypeKeyword</Key>
<Description>Type</Description>
<Enabled>0</Enabled>
<Value>0x80000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>GCHeapDumpKeyword</Key>
<Description>GCHeapDump</Description>
<Enabled>0</Enabled>
<Value>0x100000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>GCSampledObjectAllocationHighKeyword</Key>
<Description>GCSampledObjectAllocationHigh</Description>
<Enabled>0</Enabled>
<Value>0x200000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>GCHeapSurvivalAndMovementKeyword</Key>
<Description>GCHeapSurvivalAndMovement</Description>
<Enabled>0</Enabled>
<Value>0x400000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>GCHeapCollectKeyword</Key>
<Description>GCHeapCollect</Description>
<Enabled>0</Enabled>
<Value>0x800000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>GCHeapAndTypeNamesKeyword</Key>
<Description>GCHeapAndTypeNames</Description>
<Enabled>0</Enabled>
<Value>0x1000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>GCSampledObjectAllocationLowKeyword</Key>
<Description>GCSampledObjectAllocationLow</Description>
<Enabled>0</Enabled>
<Value>0x2000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>PerfTrackKeyword</Key>
<Description>PerfTrack</Description>
<Enabled>0</Enabled>
<Value>0x20000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>StackKeyword</Key>
<Description>Stack</Description>
<Enabled>0</Enabled>
<Value>0x40000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ThreadTransferKeyword</Key>
<Description>ThreadTransfer</Description>
<Enabled>0</Enabled>
<Value>0x80000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>DebuggerKeyword</Key>
<Description>Debugger</Description>
<Enabled>0</Enabled>
<Value>0x100000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>MonitoringKeyword</Key>
<Description>Monitoring</Description>
<Enabled>0</Enabled>
<Value>0x200000000</Value>
</ValueMapItem>
</KeywordsAny>
<KeywordsAll>
<Description>Events with all of these keywords are enabled</Description>
<ValueMapType>2</ValueMapType>
<Value>0x0</Value>
<ValueMapItem>
<Key>GCKeyword</Key>
<Description>GC</Description>
<Enabled>0</Enabled>
<Value>0x1</Value>
</ValueMapItem>
<ValueMapItem>
<Key>GCHandleKeyword</Key>
<Description>GCHandle</Description>
<Enabled>0</Enabled>
<Value>0x2</Value>
</ValueMapItem>
<ValueMapItem>
<Key>FusionKeyword</Key>
<Description>Binder</Description>
<Enabled>0</Enabled>
<Value>0x4</Value>
</ValueMapItem>
<ValueMapItem>
<Key>LoaderKeyword</Key>
<Description>Loader</Description>
<Enabled>0</Enabled>
<Value>0x8</Value>
</ValueMapItem>
<ValueMapItem>
<Key>JitKeyword</Key>
<Description>Jit</Description>
<Enabled>0</Enabled>
<Value>0x10</Value>
</ValueMapItem>
<ValueMapItem>
<Key>NGenKeyword</Key>
<Description>NGen</Description>
<Enabled>0</Enabled>
<Value>0x20</Value>
</ValueMapItem>
<ValueMapItem>
<Key>StartEnumerationKeyword</Key>
<Description>StartEnumeration</Description>
<Enabled>0</Enabled>
<Value>0x40</Value>
</ValueMapItem>
<ValueMapItem>
<Key>EndEnumerationKeyword</Key>
<Description>StopEnumeration</Description>
<Enabled>0</Enabled>
<Value>0x80</Value>
</ValueMapItem>
<ValueMapItem>
<Key>SecurityKeyword</Key>
<Description>Security</Description>
<Enabled>0</Enabled>
<Value>0x400</Value>
</ValueMapItem>
<ValueMapItem>
<Key>AppDomainResourceManagementKeyword</Key>
<Description>AppDomainResourceManagement</Description>
<Enabled>0</Enabled>
<Value>0x800</Value>
</ValueMapItem>
<ValueMapItem>
<Key>JitTracingKeyword</Key>
<Description>JitTracing</Description>
<Enabled>0</Enabled>
<Value>0x1000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>InteropKeyword</Key>
<Description>Interop</Description>
<Enabled>0</Enabled>
<Value>0x2000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ContentionKeyword</Key>
<Description>Contention</Description>
<Enabled>0</Enabled>
<Value>0x4000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ExceptionKeyword</Key>
<Description>Exception</Description>
<Enabled>0</Enabled>
<Value>0x8000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ThreadingKeyword</Key>
<Description>Threading</Description>
<Enabled>0</Enabled>
<Value>0x10000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>JittedMethodILToNativeMapKeyword</Key>
<Description>JittedMethodILToNativeMap</Description>
<Enabled>0</Enabled>
<Value>0x20000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>OverrideAndSuppressNGenEventsKeyword</Key>
<Description>OverrideAndSuppressNGenEvents</Description>
<Enabled>0</Enabled>
<Value>0x40000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>TypeKeyword</Key>
<Description>Type</Description>
<Enabled>0</Enabled>
<Value>0x80000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>GCHeapDumpKeyword</Key>
<Description>GCHeapDump</Description>
<Enabled>0</Enabled>
<Value>0x100000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>GCSampledObjectAllocationHighKeyword</Key>
<Description>GCSampledObjectAllocationHigh</Description>
<Enabled>0</Enabled>
<Value>0x200000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>GCHeapSurvivalAndMovementKeyword</Key>
<Description>GCHeapSurvivalAndMovement</Description>
<Enabled>0</Enabled>
<Value>0x400000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>GCHeapCollectKeyword</Key>
<Description>GCHeapCollect</Description>
<Enabled>0</Enabled>
<Value>0x800000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>GCHeapAndTypeNamesKeyword</Key>
<Description>GCHeapAndTypeNames</Description>
<Enabled>0</Enabled>
<Value>0x1000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>GCSampledObjectAllocationLowKeyword</Key>
<Description>GCSampledObjectAllocationLow</Description>
<Enabled>0</Enabled>
<Value>0x2000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>PerfTrackKeyword</Key>
<Description>PerfTrack</Description>
<Enabled>0</Enabled>
<Value>0x20000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>StackKeyword</Key>
<Description>Stack</Description>
<Enabled>0</Enabled>
<Value>0x40000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ThreadTransferKeyword</Key>
<Description>ThreadTransfer</Description>
<Enabled>0</Enabled>
<Value>0x80000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>DebuggerKeyword</Key>
<Description>Debugger</Description>
<Enabled>0</Enabled>
<Value>0x100000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>MonitoringKeyword</Key>
<Description>Monitoring</Description>
<Enabled>0</Enabled>
<Value>0x200000000</Value>
</ValueMapItem>
</KeywordsAll>
<Properties>
<Description>These additional data fields will be collected with each event</Description>
<ValueMapType>2</ValueMapType>
<Value>0</Value>
<ValueMapItem>
<Key>sid</Key>
<Description>Security Identifier</Description>
<Enabled>0</Enabled>
<Value>0x1</Value>
</ValueMapItem>
<ValueMapItem>
<Key>sessionid</Key>
<Description>Session Identifier</Description>
<Enabled>0</Enabled>
<Value>0x2</Value>
</ValueMapItem>
</Properties>
<Guid>{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}</Guid>
</TraceDataProvider>
<TraceDataProvider>
<DisplayName>Microsoft-Windows-WMI-Activity</DisplayName>
<FilterEnabled>0</FilterEnabled>
<FilterType>0</FilterType>
<Level>
<Description>Events up to this level are enabled</Description>
<ValueMapType>1</ValueMapType>
<Value>0</Value>
<ValueMapItem>
<Key>win:Error</Key>
<Description>Error</Description>
<Enabled>0</Enabled>
<Value>0x2</Value>
</ValueMapItem>
<ValueMapItem>
<Key>win:Informational</Key>
<Description>Information</Description>
<Enabled>0</Enabled>
<Value>0x4</Value>
</ValueMapItem>
<ValueMapItem>
<Key>
</Key>
<Description>
</Description>
<Enabled>-1</Enabled>
<Value>0x0</Value>
</ValueMapItem>
</Level>
<KeywordsAny>
<Description>Events with any of these keywords are enabled</Description>
<ValueMapType>2</ValueMapType>
<Value>0x0</Value>
<ValueMapItem>
<Key>Microsoft-Windows-WMI-Activity/Trace</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x8000000000000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>Microsoft-Windows-WMI-Activity/Operational</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x4000000000000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>Microsoft-Windows-WMI-Activity/Debug</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x2000000000000000</Value>
</ValueMapItem>
</KeywordsAny>
<KeywordsAll>
<Description>Events with all of these keywords are enabled</Description>
<ValueMapType>2</ValueMapType>
<Value>0x0</Value>
<ValueMapItem>
<Key>Microsoft-Windows-WMI-Activity/Trace</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x8000000000000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>Microsoft-Windows-WMI-Activity/Operational</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x4000000000000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>Microsoft-Windows-WMI-Activity/Debug</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x2000000000000000</Value>
</ValueMapItem>
</KeywordsAll>
<Properties>
<Description>These additional data fields will be collected with each event</Description>
<ValueMapType>2</ValueMapType>
<Value>0</Value>
<ValueMapItem>
<Key>sid</Key>
<Description>Security Identifier</Description>
<Enabled>0</Enabled>
<Value>0x1</Value>
</ValueMapItem>
<ValueMapItem>
<Key>sessionid</Key>
<Description>Session Identifier</Description>
<Enabled>0</Enabled>
<Value>0x2</Value>
</ValueMapItem>
</Properties>
<Guid>{1418EF04-B0B4-4623-BF7E-D74AB47BBDAA}</Guid>
</TraceDataProvider>
<TraceDataProvider>
<DisplayName>Microsoft-Windows-Crypto-DPAPI</DisplayName>
<FilterEnabled>0</FilterEnabled>
<FilterType>0</FilterType>
<Level>
<Description>Events up to this level are enabled</Description>
<ValueMapType>1</ValueMapType>
<Value>0</Value>
<ValueMapItem>
<Key>win:Error</Key>
<Description>Error</Description>
<Enabled>0</Enabled>
<Value>0x2</Value>
</ValueMapItem>
<ValueMapItem>
<Key>win:Informational</Key>
<Description>Information</Description>
<Enabled>0</Enabled>
<Value>0x4</Value>
</ValueMapItem>
<ValueMapItem>
<Key>
</Key>
<Description>
</Description>
<Enabled>-1</Enabled>
<Value>0x0</Value>
</ValueMapItem>
</Level>
<KeywordsAny>
<Description>Events with any of these keywords are enabled</Description>
<ValueMapType>2</ValueMapType>
<Value>0x40</Value>
<ValueMapItem>
<Key>ETW_TASK_BACKUPSERVICE_OPERATION</Key>
<Description>BackUp Service Operation</Description>
<Enabled>0</Enabled>
<Value>0x1</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ETW_TASK_MASTERKEY_OPERATION</Key>
<Description>Master Key Operation</Description>
<Enabled>0</Enabled>
<Value>0x2</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ETW_TASK_DATAPROTECTION_OPERATION</Key>
<Description>Data Protection Operation</Description>
<Enabled>0</Enabled>
<Value>0x4</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ETW_TASK_CREDKEY_OPERATION</Key>
<Description>Credential Key Operation</Description>
<Enabled>0</Enabled>
<Value>0x8</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ETW_TASK_DEF_INFORMATION</Key>
<Description>DPAPIDefInformationKeywordMessage</Description>
<Enabled>-1</Enabled>
<Value>0x40</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ETW_TASK_RC4_FALLBACK</Key>
<Description>DPAPIRC4FallbackKeywordMessage</Description>
<Enabled>0</Enabled>
<Value>0x80</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ETW_TASK_MASTER_KEY_BACKUP</Key>
<Description>DPAPIMasterKeyBackupKeywordMessage</Description>
<Enabled>0</Enabled>
<Value>0x100</Value>
</ValueMapItem>
<ValueMapItem>
<Key>Microsoft-Windows-Crypto-DPAPI/Operational</Key>
<Description>Microsoft-Windows-Crypto-DPAPI/Operational</Description>
<Enabled>0</Enabled>
<Value>0x8000000000000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc</Key>
<Description>Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc</Description>
<Enabled>0</Enabled>
<Value>0x4000000000000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>Microsoft-Windows-Crypto-DPAPI/Debug</Key>
<Description>Microsoft-Windows-Crypto-DPAPI/Debug</Description>
<Enabled>0</Enabled>
<Value>0x2000000000000000</Value>
</ValueMapItem>
</KeywordsAny>
<KeywordsAll>
<Description>Events with all of these keywords are enabled</Description>
<ValueMapType>2</ValueMapType>
<Value>0x0</Value>
<ValueMapItem>
<Key>ETW_TASK_BACKUPSERVICE_OPERATION</Key>
<Description>BackUp Service Operation</Description>
<Enabled>0</Enabled>
<Value>0x1</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ETW_TASK_MASTERKEY_OPERATION</Key>
<Description>Master Key Operation</Description>
<Enabled>0</Enabled>
<Value>0x2</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ETW_TASK_DATAPROTECTION_OPERATION</Key>
<Description>Data Protection Operation</Description>
<Enabled>0</Enabled>
<Value>0x4</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ETW_TASK_CREDKEY_OPERATION</Key>
<Description>Credential Key Operation</Description>
<Enabled>0</Enabled>
<Value>0x8</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ETW_TASK_DEF_INFORMATION</Key>
<Description>DPAPIDefInformationKeywordMessage</Description>
<Enabled>0</Enabled>
<Value>0x40</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ETW_TASK_RC4_FALLBACK</Key>
<Description>DPAPIRC4FallbackKeywordMessage</Description>
<Enabled>0</Enabled>
<Value>0x80</Value>
</ValueMapItem>
<ValueMapItem>
<Key>ETW_TASK_MASTER_KEY_BACKUP</Key>
<Description>DPAPIMasterKeyBackupKeywordMessage</Description>
<Enabled>0</Enabled>
<Value>0x100</Value>
</ValueMapItem>
<ValueMapItem>
<Key>Microsoft-Windows-Crypto-DPAPI/Operational</Key>
<Description>Microsoft-Windows-Crypto-DPAPI/Operational</Description>
<Enabled>0</Enabled>
<Value>0x8000000000000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc</Key>
<Description>Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc</Description>
<Enabled>0</Enabled>
<Value>0x4000000000000000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>Microsoft-Windows-Crypto-DPAPI/Debug</Key>
<Description>Microsoft-Windows-Crypto-DPAPI/Debug</Description>
<Enabled>0</Enabled>
<Value>0x2000000000000000</Value>
</ValueMapItem>
</KeywordsAll>
<Properties>
<Description>These additional data fields will be collected with each event</Description>
<ValueMapType>2</ValueMapType>
<Value>0</Value>
<ValueMapItem>
<Key>sid</Key>
<Description>Security Identifier</Description>
<Enabled>0</Enabled>
<Value>0x1</Value>
</ValueMapItem>
<ValueMapItem>
<Key>sessionid</Key>
<Description>Session Identifier</Description>
<Enabled>0</Enabled>
<Value>0x2</Value>
</ValueMapItem>
</Properties>
<Guid>{89FE8F40-CDCE-464E-8217-15EF97D4C7C3}</Guid>
</TraceDataProvider>
<TraceDataProvider>
<DisplayName>Microsoft-Windows-Kernel-Process</DisplayName>
<FilterEnabled>0</FilterEnabled>
<FilterType>0</FilterType>
<Level>
<Description>Events up to this level are enabled</Description>
<ValueMapType>1</ValueMapType>
<Value>0</Value>
<ValueMapItem>
<Key>win:Informational</Key>
<Description>Information</Description>
<Enabled>0</Enabled>
<Value>0x4</Value>
</ValueMapItem>
<ValueMapItem>
<Key>
</Key>
<Description>
</Description>
<Enabled>-1</Enabled>
<Value>0x0</Value>
</ValueMapItem>
</Level>
<KeywordsAny>
<Description>Events with any of these keywords are enabled</Description>
<ValueMapType>2</ValueMapType>
<Value>0x10</Value>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_PROCESS</Key>
<Description>
</Description>
<Enabled>-1</Enabled>
<Value>0x10</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_THREAD</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x20</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_IMAGE</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x40</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_CPU_PRIORITY</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x80</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_OTHER_PRIORITY</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x100</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_PROCESS_FREEZE</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x200</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_JOB</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x400</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_ENABLE_PROCESS_TRACING_CALLBACKS</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x800</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_JOB_IO</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x1000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_WORK_ON_BEHALF</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x2000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_JOB_SILO</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x4000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>Microsoft-Windows-Kernel-Process/Analytic</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x8000000000000000</Value>
</ValueMapItem>
</KeywordsAny>
<KeywordsAll>
<Description>Events with all of these keywords are enabled</Description>
<ValueMapType>2</ValueMapType>
<Value>0x0</Value>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_PROCESS</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x10</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_THREAD</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x20</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_IMAGE</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x40</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_CPU_PRIORITY</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x80</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_OTHER_PRIORITY</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x100</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_PROCESS_FREEZE</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x200</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_JOB</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x400</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_ENABLE_PROCESS_TRACING_CALLBACKS</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x800</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_JOB_IO</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x1000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_WORK_ON_BEHALF</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x2000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>WINEVENT_KEYWORD_JOB_SILO</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x4000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>Microsoft-Windows-Kernel-Process/Analytic</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x8000000000000000</Value>
</ValueMapItem>
</KeywordsAll>
<Properties>
<Description>These additional data fields will be collected with each event</Description>
<ValueMapType>2</ValueMapType>
<Value>0</Value>
<ValueMapItem>
<Key>sid</Key>
<Description>Security Identifier</Description>
<Enabled>0</Enabled>
<Value>0x1</Value>
</ValueMapItem>
<ValueMapItem>
<Key>sessionid</Key>
<Description>Session Identifier</Description>
<Enabled>0</Enabled>
<Value>0x2</Value>
</ValueMapItem>
</Properties>
<Guid>{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}</Guid>
</TraceDataProvider>
<TraceDataProvider>
<DisplayName>Microsoft-Windows-Kernel-File</DisplayName>
<FilterEnabled>0</FilterEnabled>
<FilterType>0</FilterType>
<Level>
<Description>Events up to this level are enabled</Description>
<ValueMapType>1</ValueMapType>
<Value>0</Value>
<ValueMapItem>
<Key>win:Informational</Key>
<Description>Information</Description>
<Enabled>0</Enabled>
<Value>0x4</Value>
</ValueMapItem>
<ValueMapItem>
<Key>
</Key>
<Description>
</Description>
<Enabled>-1</Enabled>
<Value>0x0</Value>
</ValueMapItem>
</Level>
<KeywordsAny>
<Description>Events with any of these keywords are enabled</Description>
<ValueMapType>2</ValueMapType>
<Value>0x1000</Value>
<ValueMapItem>
<Key>KERNEL_FILE_KEYWORD_FILENAME</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x10</Value>
</ValueMapItem>
<ValueMapItem>
<Key>KERNEL_FILE_KEYWORD_FILEIO</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x20</Value>
</ValueMapItem>
<ValueMapItem>
<Key>KERNEL_FILE_KEYWORD_OP_END</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x40</Value>
</ValueMapItem>
<ValueMapItem>
<Key>KERNEL_FILE_KEYWORD_CREATE</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x80</Value>
</ValueMapItem>
<ValueMapItem>
<Key>KERNEL_FILE_KEYWORD_READ</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x100</Value>
</ValueMapItem>
<ValueMapItem>
<Key>KERNEL_FILE_KEYWORD_WRITE</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x200</Value>
</ValueMapItem>
<ValueMapItem>
<Key>KERNEL_FILE_KEYWORD_DELETE_PATH</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x400</Value>
</ValueMapItem>
<ValueMapItem>
<Key>KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x800</Value>
</ValueMapItem>
<ValueMapItem>
<Key>KERNEL_FILE_KEYWORD_CREATE_NEW_FILE</Key>
<Description>
</Description>
<Enabled>-1</Enabled>
<Value>0x1000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>Microsoft-Windows-Kernel-File/Analytic</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x8000000000000000</Value>
</ValueMapItem>
</KeywordsAny>
<KeywordsAll>
<Description>Events with all of these keywords are enabled</Description>
<ValueMapType>2</ValueMapType>
<Value>0x0</Value>
<ValueMapItem>
<Key>KERNEL_FILE_KEYWORD_FILENAME</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x10</Value>
</ValueMapItem>
<ValueMapItem>
<Key>KERNEL_FILE_KEYWORD_FILEIO</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x20</Value>
</ValueMapItem>
<ValueMapItem>
<Key>KERNEL_FILE_KEYWORD_OP_END</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x40</Value>
</ValueMapItem>
<ValueMapItem>
<Key>KERNEL_FILE_KEYWORD_CREATE</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x80</Value>
</ValueMapItem>
<ValueMapItem>
<Key>KERNEL_FILE_KEYWORD_READ</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x100</Value>
</ValueMapItem>
<ValueMapItem>
<Key>KERNEL_FILE_KEYWORD_WRITE</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x200</Value>
</ValueMapItem>
<ValueMapItem>
<Key>KERNEL_FILE_KEYWORD_DELETE_PATH</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x400</Value>
</ValueMapItem>
<ValueMapItem>
<Key>KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x800</Value>
</ValueMapItem>
<ValueMapItem>
<Key>KERNEL_FILE_KEYWORD_CREATE_NEW_FILE</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x1000</Value>
</ValueMapItem>
<ValueMapItem>
<Key>Microsoft-Windows-Kernel-File/Analytic</Key>
<Description>
</Description>
<Enabled>0</Enabled>
<Value>0x8000000000000000</Value>
</ValueMapItem>
</KeywordsAll>
<Properties>
<Description>These additional data fields will be collected with each event</Description>
<ValueMapType>2</ValueMapType>
<Value>0</Value>
<ValueMapItem>
<Key>sid</Key>
<Description>Security Identifier</Description>
<Enabled>0</Enabled>
<Value>0x1</Value>
</ValueMapItem>
<ValueMapItem>
<Key>sessionid</Key>
<Description>Session Identifier</Description>
<Enabled>0</Enabled>
<Value>0x2</Value>
</ValueMapItem>
</Properties>
<Guid>{EDD08927-9CC4-4E65-B970-C2560FB5C289}</Guid>
</TraceDataProvider>
</TraceDataCollector>
</DataCollectorSet>
Reference in New Issue View Git Blame Copy Permalink