mirror of
https://github.com/repnz/etw-providers-docs
synced 2026-06-08 17:06:44 +00:00
repnz
53 lines
3.4 KiB
XML
53 lines
3.4 KiB
XML
<instrumentationManifest xmlns="http://schemas.microsoft.com/win/2004/08/events">
|
|
<instrumentation xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events">
|
|
<events>
|
|
<provider name="Microsoft-Windows-Security-EnterpriseData-FileRevocationManager" guid="{2cd58181-0bb6-463e-828a-056ff837f966}" resourceFileName="Microsoft-Windows-Security-EnterpriseData-FileRevocationManager" messageFileName="Microsoft-Windows-Security-EnterpriseData-FileRevocationManager" symbol="MicrosoftWindowsSecurityEnterpriseDataFileRevocationManager" source="Xml" >
|
|
<keywords>
|
|
</keywords>
|
|
<tasks>
|
|
<task name="task_0" message="$(string.task_task_0)" value="0">
|
|
>
|
|
<opcodes>
|
|
<opcode name="ProtectIdentityoperation." message="$(string.opcode_task_0ProtectIdentityoperation.)" value="10"/>
|
|
<opcode name="RevokeIdentityoperation." message="$(string.opcode_task_0RevokeIdentityoperation.)" value="11"/>
|
|
<opcode name="Delegationoperation." message="$(string.opcode_task_0Delegationoperation.)" value="12"/>
|
|
</opcodes>
|
|
</task>
|
|
</tasks>
|
|
<events>
|
|
<event value="0" symbol="task_0ProtectIdentityoperation." version="0" task="task_0" opcode="ProtectIdentityoperation." level="win:Informational" template="task_0ProtectIdentityoperation.Args"/>
|
|
<event value="1" symbol="task_0ProtectIdentityoperation.1" version="0" task="task_0" opcode="ProtectIdentityoperation." level="win:Informational" template="task_0ProtectIdentityoperation.1Args"/>
|
|
<event value="17" symbol="task_0RevokeIdentityoperation." version="0" task="task_0" opcode="RevokeIdentityoperation." level="win:Informational" template="task_0ProtectIdentityoperation.Args"/>
|
|
<event value="18" symbol="task_0RevokeIdentityoperation.18" version="0" task="task_0" opcode="RevokeIdentityoperation." level="win:Informational" template="task_0ProtectIdentityoperation.Args"/>
|
|
<event value="19" symbol="task_0RevokeIdentityoperation.19" version="0" task="task_0" opcode="RevokeIdentityoperation." level="win:Informational" template="task_0ProtectIdentityoperation.1Args"/>
|
|
<event value="20" symbol="task_0Delegationoperation." version="0" task="task_0" opcode="Delegationoperation." level="win:Informational" template="task_0Delegationoperation.Args"/>
|
|
</events>
|
|
<templates>
|
|
<template tid="task_0ProtectIdentityoperation.Args">
|
|
<data name="EntIDString" inType="win:UnicodeString"/>
|
|
<data name="AppIDString" inType="win:UnicodeString"/>
|
|
</template>
|
|
<template tid="task_0ProtectIdentityoperation.1Args">
|
|
<data name="EntIDString" inType="win:UnicodeString"/>
|
|
<data name="AppIDString" inType="win:UnicodeString"/>
|
|
<data name="ErrorCode" inType="win:HexInt32"/>
|
|
</template>
|
|
<template tid="task_0Delegationoperation.Args">
|
|
<data name="PolicyString" inType="win:UnicodeString"/>
|
|
</template>
|
|
</templates>
|
|
</provider>
|
|
</events>
|
|
</instrumentation>
|
|
<localization>
|
|
<resources culture="en-US">
|
|
<stringTable>
|
|
<string id="task_task_0" value="task_0"/>
|
|
<string id="opcode_task_0ProtectIdentityoperation." value="ProtectIdentityoperation."/>
|
|
<string id="opcode_task_0RevokeIdentityoperation." value="RevokeIdentityoperation."/>
|
|
<string id="opcode_task_0Delegationoperation." value="Delegationoperation."/>
|
|
</stringTable>
|
|
</resources>
|
|
</localization>
|
|
</instrumentationManifest>
|