VQL Reference Windows etw_sessions etw_sessions Plugin Arg Description Type count The count of sessions to retrieve (default 64) uint64 Required permissions: MACHINE_STATE Description Enumerates all active ETW sessions