Announcements
Current CVEs
Trainings
VeloCON 2023
Documentation
Velociraptor Overview
History
Support Policy
Deployment
Self-Signed SSL
Cloud Deployment
Multi-Frontend
Deploying Clients
Users and Roles
Performance
Troubleshooting
Config Reference
The Admin GUI
Inspecting clients
The VFS
Artifacts
Hunting
VQL Fundamentals
Notebooks
Artifacts
Event Queries
Forensic Analysis
Searching Filenames
Searching Content
NTFS Analysis
Binary parsing
Evidence Of Execution
Event Logs
Volatile State
Triage and acquisition
Remote Uploads
Client Monitoring
Extending VQL
Server Automation
Server API
Server Monitoring
VQL Reference
Basic VQL
Linux Specific
Windows Specific
Parsers
Server Side
Client Side
Event Plugins
Experimental
Misc
Training
Blog
Presentations
Linux Conf Au 2022
Auscert 2022
DFRWS US 2022
Tech Users Group 2022
SANS Summit 2022
Velocon 2022
DFRWS APAC 2022
EverythingOpen 2023
Auscert 2023
Artifact Exchange
Artifact Reference
Knowledge Base
Search
Github
Discord
Mailing List
RSS
watch_etw
watch_etw
Description
watch_etw
Plugin
Arg
Description
Type
name
A session name
string
guid
A Provider GUID to watch
string (required)
any
Any Keywords
uint64
all
All Keywords
uint64
level
Log level (0-5)
int64
Description
Watch for events from an ETW provider.