Windows application platform event channels
Application platform and user shell channels, bound as one feed: packaged-app deployment and readiness, the shell and modern app launch surface, application compatibility, Windows Error Reporting health, and Office alert dialogs. Light curation: severity capped at Warning, nothing dropped, no reasons yet.
Feed id: win.eventlog.apps.
Channels
This feed binds 25 Windows Event Log channels as one reporting axis. A channel that a given Windows edition, role or OEM does not provide is absent on that endpoint; the rest still collect.
The ticket class is the subject area an event on the channel is evidence for, and it is what fleet-wide questions group by.
| Channel | Ticket class |
|---|---|
Microsoft-Windows-AppID/Operational | security_audit |
Microsoft-Windows-Application Server-Applications/Operational | app_stability |
Microsoft-Windows-Application-Experience/Program-Inventory | inventory |
Microsoft-Windows-ApplicationResourceManagementSystem/Operational | app_stability |
Microsoft-Windows-AppModel-Runtime/Admin | app_stability |
Microsoft-Windows-AppReadiness/Admin | app_stability |
Microsoft-Windows-AppReadiness/Operational | app_stability |
Microsoft-Windows-AppXDeployment-Server/Operational | patching |
Microsoft-Windows-AppXDeployment/Operational | patching |
Microsoft-Windows-AppXDeploymentServer/Operational | patching |
Microsoft-Windows-AppXDeploymentServer/Restricted | patching |
Microsoft-Windows-AppxPackaging/Operational | patching |
Microsoft-Windows-Containers-BindFlt/Operational | app_stability |
Microsoft-Windows-Containers-Wcifs/Operational | app_stability |
Microsoft-Windows-CoreApplication/Operational | app_stability |
Microsoft-Windows-Diagnosis-PCW/Operational | app_stability |
Microsoft-Windows-Fault-Tolerant-Heap/Operational | app_stability |
Microsoft-Windows-Kernel-ShimEngine/Operational | app_stability |
Microsoft-Windows-Shell-Core/Operational | app_stability |
Microsoft-Windows-TWinUI/Operational | app_stability |
Microsoft-Windows-UAC-FileVirtualization/Operational | app_stability |
Microsoft-Windows-WER-Diag/Operational | app_stability |
Microsoft-Windows-WER-PayloadHealth/Operational | app_stability |
OAlerts | app_stability |
OSession | app_stability |
Severity
This feed is bound for collection but is not yet curated per event. Every event keeps the severity its own provider stated, capped at Warning.
Ask this feed a question
Every reason code, token and field on this page is queryable across the endpoints you manage. Connect your AI and ask in plain language, or open the same evidence in Explore.