Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Event Tracing For Windows (ETW) Resources
| Date | Stars |
|---|---|
| 2026-07-24 | 433 |
| 2026-07-25 | 433 |
| 2026-07-28 | 433 |
| 2026-07-30 | 433 |
| 2026-08-06 | 433 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
0.0
growth rate 0.00%/day
# EVTX/ETW Resources
This is a repository that contains a bunch of resources to learn and understand EVTX/ETW (Event Tracing for Windows)
## A Quick Rundown
Here's what you can expect from each of the main subfolders within this repo. Please take a minute to educate yourself!
### ETWProvidersManifests
[ETWProvidersManifests](https://github.com/nasbench/EVTX-ETW-Resources/tree/main/ETWProvidersManifests) will contain raw XMLs for each Event Log Provider for each respective version of Windows. At minimum, there should be 800 of these for each system. An example can be seen below:
### ETWProvidersCSVs
[ETWProvidersCSVs](https://github.com/nasbench/EVTX-ETW-Resources/tree/main/ETWProvidersCSVs) will contain a CSV for each Provider and all the possible event IDs, event messages, etc contained within that Provider. An example can be seen below:
Within the ETWProvidersCSVs subfolder, there are two other subfolders that separate Windows-native and Third-Party Event Log Providers.
#### Internal
Any Event Log Provider that exists upon a clean install of Windows will be included here.
#### ThirdParty
Any Event Log Provider that doesn't ship with Windows will be included here. Some examples can include, but are not limited to: Third-Party Antivirus, Sysmon, Microsoft Office (technically doesn't ship with Windows), or Remote Admin Tools like Splashtop.
### ETWEventsList
[ETWEventsList](https://github.com/nasbench/EVTX-ETW-Resources/tree/main/ETWEventsList) will provide a CSV for each respective version of Windows that contains ALL of the possible event IDs, event messages, etc for that version of Windows. This is offered in a combined CSV for ALL Providers as well as each Provider separated out into their own CSV for that specific version of Windows. An example can be seen below:
### Examples
[Examples](https://github.com/nasbench/ETW-Resources/tree/main/Examples) will contain example scripts to collect ETW events using different libraries.
## Content
- [EVTX/ETW Resources](#evtxetw-resources)
- [Content](#content)
- [Structure](#structure)
- [Blogs / Research (<https://nasbench.medium.com/>)](#blogs--research-httpsnasbenchmediumcom)
- [Tools](#tools)
- [Interacting w/ ETW](#interacting-w-etw)
- [Dumping ETW Providers Manifest](#dumping-etw-providers-manifest)
- [Scripting w/ ETW (Detection, Digital Forensics)](#scripting-w-etw-detection-digital-forensics)
- [Online Resources](#online-resources)
- [Architecture](#architecture)
- [Research](#research)
- [Talks](#talks)
- [Books](#books)
- [Other Github Projects w/ ETW Content](#other-github-projects-w-etw-content)
- [Contributing](#contributing)
## Blogs / Research (<https://nasbench.medium.com/>)
- [A Primer On Event Tracing For Windows (ETW)](https://nasbench.medium.com/a-primer-on-event-tracing-for-windows-etw-997725c082bf)
- [Finding Detection and Forensic Goodness In ETW Providers](https://nasbench.medium.com/finding-detection-and-forensic-goodness-in-etw-providers-7c7a2b5b5f4f)
- [Windows 11 “New” ETW Providers — Overview](https://nasbench.medium.com/windows-11-new-etw-providers-overview-a2a5fbc85775)
## Tools
The following is a list of tools that can let us interact with the different ETW providers available. The examples directory contains example scripts and commands on how to use these tools
### Interacting w/ ETW
- [**Logman**](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/logman)
- [**Microsoft.Diagnostics.Tracing.TraceEvent**](nuget.org/packages/Microsoft.Diagnostics.Tracing.TraceEvent/)
- [**Message Analyzer**](https://github.com/riverar/messageanalyzer-archive)
### Dumping ETW ProExcerpt of 9,644 characters
Read on GitHubWould you bet a product on this? Bounded 0–100 and slow moving.
matched fp:2ef124197c199f65, topic:tracing