deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-21 13:23:36 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Merged PR 6328: Diagnostic data changes for March update

Browse Source
This commit is contained in:
Jeanie Decker
2018-03-13 14:44:01 +00:00
parent d12118140d
commit 4ffd88ad03
3 changed files with 66 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
windows/configuration/basic-level-windows-diagnostic-events-and-fields.md
View File

@ -9,7 +9,7 @@ ms.pagetype: security
localizationpriority: high
author: eross-msft
ms.author: lizross
ms.date: 02/12/2018
ms.date: 03/13/2018
---
@ -317,6 +317,8 @@ This event represents the basic metadata about a file on the system. The file m
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file generating the events.
- **AvDisplayName** The version of the Appraiser file generating the events.
- **AvProductState** If the app is an anti-virus app, this is its display name.
- **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64
- **BinFileVersion** An attempt to clean up FileVersion at the client that tries to place the version into 4 octets.
- **BinProductVersion** An attempt to clean up ProductVersion at the client that tries to place the version into 4 octets.
@ -324,6 +326,8 @@ The following fields are available:
- **CompanyName** The company name of the vendor who developed this file.
- **FileId** A hash that uniquely identifies a file.
- **FileVersion** The File version field from the file metadata under Properties -> Details.
- **HasUpgradeExe** Represents state of antivirus program with respect to whether it's turned on and the signatures are up-to-date.
- **IsAv** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64
- **LinkDate** The date and time that this file was linked on.
- **LowerCaseLongPath** The full file path to the file that was inventoried on the device.
- **Name** The name of the file that was inventoried.
@ -332,6 +336,23 @@ The following fields are available:
- **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it.
- **Size** The size of the file (in hexadecimal bytes).
### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd
This event represents the drivers that an application installs.
The following fields are available:
- **InventoryVersion** The version of the inventory component
- **Programids** The unique program identifier the driver is associated with.
## Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync
This event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent.
The following fields are available:
- **InventoryVersion** The version of the inventory component.
### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd
@ -1593,6 +1614,9 @@ This event sends data about the processor (architecture, speed, number of cores,
The following fields are available:
- **KvaShadow** Microcode info of the processor.
- **MMSettingOverride** Microcode setting of the processor.
- **MMSettingOverrideMask** Microcode setting override of the processor.
- **ProcessorArchitecture** Retrieves the processor architecture of the installed operating system. The complete list of values can be found in DimProcessorArchitecture.
- **ProcessorClockSpeed** Retrieves the clock speed of the processor in MHz.
- **ProcessorCores** Retrieves the number of cores in the processor.
@ -1602,6 +1626,7 @@ The following fields are available:
- **ProcessorPhysicalCores** Number of physical cores in the processor.
- **ProcessorUpdateRevision** The microcode version.
- **SocketCount** Number of physical CPU sockets of the machine.
- **SpeculationControl** Clock speed of the processor in MHz.
### Census.Security