Windows network event channels
Connectivity, name resolution, file sharing and remote access channels, bound as one feed: DHCP, DNS client, WLAN, connectivity probes, the firewall and filtering platform, SMB client and server, RDP and SSH. Light curation: severity capped at Warning, nothing dropped, no reasons yet.
Feed id: win.eventlog.network.
Channels
This feed binds 43 Windows Event Log channels as one reporting axis. A channel that a given Windows edition, role or OEM does not provide is absent on that endpoint; the rest still collect.
The ticket class is the subject area an event on the channel is evidence for, and it is what fleet-wide questions group by.
| Channel | Ticket class |
|---|---|
Microsoft-Windows-AllJoyn/Operational | networking |
Microsoft-Windows-BranchCacheSMB/Operational | file_sharing |
Microsoft-Windows-CloudFiles-Filter/Operational | file_sync |
Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational | networking |
Microsoft-Windows-Dhcp-Client/Admin | networking |
Microsoft-Windows-Dhcp-Client/Operational | networking |
Microsoft-Windows-Dhcpv6-Client/Admin | networking |
Microsoft-Windows-DNS-Client/Operational | networking |
Microsoft-Windows-EapHost/Operational | auth |
Microsoft-Windows-Host-Network-Service-Admin | networking |
Microsoft-Windows-Host-Network-Service-Operational | networking |
Microsoft-Windows-NcdAutoSetup/Operational | networking |
Microsoft-Windows-NCSI/Operational | networking |
Microsoft-Windows-NetworkLocationWizard/Operational | networking |
Microsoft-Windows-NetworkProfile/Operational | networking |
Microsoft-Windows-NlaSvc/Operational | networking |
Microsoft-Windows-OfflineFiles/Operational | file_sharing |
Microsoft-Windows-RemoteAssistance/Operational | remote_access |
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin | remote_access |
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational | remote_access |
Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational | remote_access |
Microsoft-Windows-SmbClient/Connectivity | file_sharing |
Microsoft-Windows-SMBClient/Operational | file_sharing |
Microsoft-Windows-SmbClient/Security | file_sharing |
Microsoft-Windows-SMBServer/Connectivity | file_sharing |
Microsoft-Windows-SMBServer/Operational | file_sharing |
Microsoft-Windows-SMBServer/Security | file_sharing |
Microsoft-Windows-TerminalServices-LocalSessionManager/Admin | remote_access |
Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | remote_access |
Microsoft-Windows-TerminalServices-PnPDevices/Admin | remote_access |
Microsoft-Windows-TerminalServices-Printers/Admin | printing |
Microsoft-Windows-TerminalServices-RDPClient/Operational | remote_access |
Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin | remote_access |
Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational | remote_access |
Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin | remote_access |
Microsoft-Windows-Wcmsvc/Operational | networking |
Microsoft-Windows-WFP/Operational | networking |
Microsoft-Windows-Windows Firewall With Advanced Security/Firewall | networking |
Microsoft-Windows-Windows Firewall With Advanced Security/FirewallDiagnostics | networking |
Microsoft-Windows-WinINet-Config/ProxyConfigChanged | networking |
Microsoft-Windows-WLAN-AutoConfig/Operational | networking |
OpenSSH/Admin | remote_access |
OpenSSH/Operational | remote_access |
Severity
This feed is bound for collection but is not yet curated per event. Every event keeps the severity its own provider stated, capped at Warning.
Ask this feed a question
Every reason code, token and field on this page is queryable across the endpoints you manage. Connect your AI and ask in plain language, or open the same evidence in Explore.