mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-29 05:37:22 +00:00
checkpoint
This commit is contained in:
Brian Lich
parent
82dece5fb5
commit
f1cf0676cc
@ -0,0 +1,148 @@
|
|||||||
|
---
|
||||||
|
description: Use this article to make informed decisions about how you can configure telemetry in your organization.
|
||||||
|
title: Basic level Windows telemetry events and fields (Windows 10)
|
||||||
|
keywords: privacy
|
||||||
|
ms.prod: w10
|
||||||
|
ms.mktglfcycl: manage
|
||||||
|
ms.sitesec: library
|
||||||
|
ms.pagetype: security
|
||||||
|
localizationpriority: high
|
||||||
|
author: brianlic-msft
|
||||||
|
---
|
||||||
|
|
||||||
|
# Basic level Windows telemetry events and fields
|
||||||
|
|
||||||
|
**Applies to**
|
||||||
|
|
||||||
|
- Windows 10
|
||||||
|
|
||||||
|
Add preface and cover page here (Steve May to provide)
|
||||||
|
|
||||||
|
## Common data events
|
||||||
|
|
||||||
|
The fields in this section contain common device data that is added to every event.
|
||||||
|
|
||||||
|
**Common data - Device extension**
|
||||||
|
|
||||||
|
| Field | Description |
|
||||||
|
| - | - |
|
||||||
|
| localId | Represents a locally defined unique ID for the device, not the human readable device name. Most likely equal to the value stored at HKLM\Software\Microsoft\SQMClient\MachineId |
|
||||||
|
| deviceClass | Represents the classification of the device, the device “family”. For example, Desktop, Server, or Mobile.|
|
||||||
|
|
||||||
|
**Common data - Envelope extension**
|
||||||
|
|
||||||
|
| Field | Description |
|
||||||
|
| - | - |
|
||||||
|
| Ver | Represents the major and minor version of the envelope.|
|
||||||
|
| name | Represents the uniquely qualified name for the event.|
|
||||||
|
| time | Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format.|
|
||||||
|
| popSample | Represents the effective sample rate for this event at the time it was generated by a client.|
|
||||||
|
| epoch | Represents the epoch and seqNum fields, which help track how many events were fired and how many events were uploaded, and enables identification of data lost during upload and de-duplication of events on the ingress server.|
|
||||||
|
| seqNum | Represents the sequence field used to track absolute order of uploaded events. It is an incrementing identifier for each event added to the upload queue. The Sequence helps track how many events were fired and how many events were uploaded and enables identification of data lost during upload and de-duplication of events on the ingress server.|
|
||||||
|
| iKey | Represents an ID for applications or other logical groupings of events. |
|
||||||
|
| flags | Represents a collection of bits that describe how the event should be processed by the Connected User Experience and Telemetry component pipeline. The lowest-order byte is the event persistence. The next byte is the event latency.|
|
||||||
|
| os | Represents the operating system name.|
|
||||||
|
| osVer | Represents the OS version, and its format is OS dependent.|
|
||||||
|
| appId | Represents a unique identifier of the client application currently loaded in the process producing the event; and is used to group events together and understand usage pattern, errors by application.|
|
||||||
|
| appVer | Represents the version number of the application. Used to understand errors by Version, Usage by Version across an App.|
|
||||||
|
| cV | Represents the Correlation Vector: A single field for tracking partial order of related telemetry events across component boundaries.|
|
||||||
|
| tags | Represents the pre-release build "flight ID" |
|
||||||
|
|
||||||
|
**Common data - OS extension**
|
||||||
|
|
||||||
|
| Field | Description |
|
||||||
|
| - | - |
|
||||||
|
| expId | Represents the “experiment ID”. The standard for associating a flight, such as an OS flight (pre-release build), or an experiment, such as a web site UX experiment, with an event is to record the flight / experiment IDs in Part A of the common schema.|
|
||||||
|
|
||||||
|
**Common data - Telemetry extension**
|
||||||
|
|
||||||
|
| Field | Description |
|
||||||
|
| - | - |
|
||||||
|
| stId | Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID. |
|
||||||
|
| aId | Represents the ETW ActivityId. Logged via TraceLogging or directly via ETW. |
|
||||||
|
| raId | Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW.|
|
||||||
|
| Op | Represents the ETW Op Code.|
|
||||||
|
| cat | Represents a bitmask of the ETW Keywords associated with the event.|
|
||||||
|
| flags | Represents the bitmap that captures various Windows specific flags.|
|
||||||
|
|
||||||
|
**Common data - User extension**
|
||||||
|
|
||||||
|
| Field | Description |
|
||||||
|
| - | - |
|
||||||
|
| localId | Represents a unique user identity that is created locally and added by the client. This is not the user's account ID.|
|
||||||
|
|
||||||
|
## Consent UI
|
||||||
|
|
||||||
|
This User Account Control (UAC) event collects information on elevations that originate from low integrity levels. This occurs when a process running at low integrity level (IL) requires higher (administrator) privileges, and therefore requests for elevation via UAC (consent.exe). By better understanding the processes requesting these elevations, Microsoft can in turn improve the detection and handling of potentially malicious behavior in this path.
|
||||||
|
|
||||||
|
| Field | Description |
|
||||||
|
| - | - |
|
||||||
|
| eventType | Represents the type of elevation: If it succeeded, was cancelled, or was auto-approved. |
|
||||||
|
| splitToken | Represents the flag used to distinguish between Admin and Standard Users. |
|
||||||
|
| friendlyName | Represents the name of the file requesting elevation from low IL. |
|
||||||
|
| elevationReason | Represents the distinction between various elevation requests sources (appcompat, installer, COM, MSI and so on). |
|
||||||
|
| exeName | Represents the name of the file requesting elevation from low IL. |
|
||||||
|
| signatureState | Represents the state of the signature, if it signed, unsigned, OS signed and so on. |
|
||||||
|
| publisherName | Represents the name of the publisher of the file requesting elevation from low IL. |
|
||||||
|
| cmdLine | Represents the full command line arguments being used to elevate. |
|
||||||
|
| Hash.Length | Represents the length of the hash of the file requesting elevation from low IL. |
|
||||||
|
| Hash | Represents the hash of the file requesting elevation from low IL. |
|
||||||
|
| HashAlgId | Represents the algorithm ID of the hash of the file requesting elevation from low IL. |
|
||||||
|
| telemetryFlags | Represents the details about the elevation prompt for CEIP data. |
|
||||||
|
| timeStamp | Represents the time stamp on the file requesting elevation |
|
||||||
|
| fileVersionMS | Represents the major version of the file requesting elevation |
|
||||||
|
| fileVersionLS | Represents the minor version of the file requesting elevation |
|
||||||
|
|
||||||
|
## Appraiser
|
||||||
|
|
||||||
|
Appraiser Core Data events provide an inventory of what is on the device for the purposes of understanding compatibility and upgrade issues. This device inventory gathers information such as all the applications on the device, IE Add-ons, drivers on the device, and peripherals attached to the device. Appraiser reviews the device inventory to see if it is compatible/ready for upgrade, and for problems that might need to be addressed by the upgrade.
|
||||||
|
|
||||||
|
### Microsoft.Windows.Appraiser.General
|
||||||
|
|
||||||
|
These events represent the basic metadata about an application installed on the system.
|
||||||
|
|
||||||
|
**Microsoft.Windows.Appraiser.General.InventoryApplicationAdd**
|
||||||
|
|
||||||
|
This event represents the basic metadata about an application installed on the system.
|
||||||
|
|
||||||
|
| Field | Description |
|
||||||
|
| - | - |
|
||||||
|
| objectInstanceId | ProgramId (a hash of Name, Version, Publisher, and Language of an application used to identify it). Example: 00000144865763f3de24c2ae5a289fde6db300000904
|
||||||
|
| HiddenArp | Indicates whether a program hides itself from showing up in ARP. Example: TRUE
|
||||||
|
| InstallDate | The date the application was installed (a best guess based on folder creation date heuristics) Example: 4/12/2015 01:27:52
|
||||||
|
| InstallDateArpLastModified | The date of the registry ARP key for a given application. Hints at install date but not always accurate. Passed as an array. Example: 4/11/2015 00:00:00
|
||||||
|
| InstallDateFromLinkFile | The estimated date of install based on the links to the files. Passed as an array. Example: 4/8/2015 01:06:11
|
||||||
|
| InstallDateMsi | The install date if the application was installed via MSI. Passed as an array. Example: 4/11/2015 00:00:00
|
||||||
|
| Language | The language code of the program. Language codes can be found at http://support.microsoft.com/kb/221435 Example: 1033
|
||||||
|
| MsiPackageCode | A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage. Example: {1BCC5142-D98C-430B-B74A-484A0328A7CE}
|
||||||
|
| MsiProductCode | A GUID that describe the MSI Product. Example: {365812a8-44d6-422e-b737-d540451e5f4e}
|
||||||
|
| Name | The name of the application. Location pulled from depends on 'Source' field. Example:
|
||||||
|
| OSVersionAtInstallTime | The four octets from the OS version at the time of the application's install. Example:
|
||||||
|
| PackageFullName | The package full name for a Store application. Example: Microsoft.Hexic_1.2.0.36_x86__8wekyb3d8bbwe
|
||||||
|
| ProgramInstanceId | A hash of the file IDs in a program. Used to identify application install footprint. Example: 00002a54cb9c5bc6946b99d4180fec12d6c1103ad849
|
||||||
|
| Publisher | The Publisher of the application. Location pulled from depends on the 'Source' field. Example: Neudesic
|
||||||
|
| RootDirPath | The path to the root directory where the program was installed. Example: %ProgramFiles% (x86)\Neudesic\Azure Storage Explorer 6
|
||||||
|
| Source | Where the data for the application was found, such as Add/Remove Programs (ARP), MSI, AppxPackage, etc. Example: Msi
|
||||||
|
| Type | One of ("Application", "Hotfix", "BOE", "Service", "Unknown"). Application indicates Win32 or Appx app, Hotfix indicates app updates (KBs), BOE indicates it's an app with no ARP or MSI entry, Service indicates that it is a service. Application and BOE are the ones most likely seen. Example: Application|
|
||||||
|
| Version | The version number of the program. Example: 6.00.0003|
|
||||||
|
|
||||||
|
**Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd**
|
||||||
|
|
||||||
|
This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or are part of an anti-virus program.
|
||||||
|
|
||||||
|
| Field | Description |
|
||||||
|
| - | - |
|
||||||
|
| objectInstanceId | LongPathHash: A hash of the full file path including the file name. Example: 00002e017145d5fedc3dd5dd4027b1da51d17ca2a0a3 |
|
||||||
|
| BinFileVersion | An attempt to clean up FileVersion at the client that tries to place the version into 4 octets. Example: 12.0.31101.0 |
|
||||||
|
| BinProductVersion | An attempt to clean up ProductVersion at the client that tries to place the version into 4 octets. Example: 12.0.31101.0 |
|
||||||
|
| BinaryType | One of ("UNINITIALIZED", "ZERO_BYTE", "DATA_ONLY", "DOS_MODULE", "NE16_MODULE", "PE32_UNKNOWN", "PE32_I386", "PE32_ARM", "PE64_UNKNOWN", "PE64_AMD64", "PE64_ARM64", "PE64_IA64", "PE32_CLR_32", "PE32_CLR_IL", "PE32_CLR_IL_PREFER32", "PE64_CLR_64"). Example: PE32_I386 |
|
||||||
|
| BoeProgramId | The ProgramId generated from the file metadata if the file is an orphan file (no ARP, MSI, etc. entry). BOE means Bag of Evidence. |
|
||||||
|
| CompanyName | The company name of the vendor who developed this file. Example: Microsoft Corporation |
|
||||||
|
| FileId | A hash that uniquely identifies a file. Example: 0000eef5472f6619824665a9c118cffea67b3727f0e1 |
|
||||||
|
| FileVersion | The File version field from the file metadata under Properties -> Details. Example: 12.0.31101.0 built by: REL |
|
||||||
|
| LinkDate | The DateTime this file was linked on. Example: 11/1/2014 7:09:24 AM |
|
||||||
|
| LowerCaseLongPath | The full file path of the executable on the machine this was file was inventoried on. Example: %ProgramFiles% (x86)\microsoft visual studio 12.0\common7\ide\devenv.exe |
|
||||||
|
| Name | The name of the file that was inventoried. For example, excel.exe |
|
||||||
|
| ProductName | The Product name field from the file metadata under Properties -> Details. Example: Microsoft® Visual Studio® 2013 |
|
||||||
|
| ProductVersion | The Product version field from the file metadata under Properties -> Details. Example: 12.0.31101.0 |
|
||||||
|
| ProgramId | A hash of Name, Version, Publisher, and Language of an application used to identify it. Example: 00004a73716911b8bb891ec1f536f2bf500b00000904 |
|
||||||
Loading…
x
Reference in New Issue
Block a user