John U

☝️ That was me. 😃 That workaround was for dumping ([MOF](https://learn.microsoft.com/en-us/windows/win32/etw/event-tracing-mof-classes)) metadata for legacy (non-manifest) providers. For these providers, returning "not found" when querying for a manifest is likely valid....

Was Elastic Endpoint one of the products evaluated? * https://www.elastic.co/docs/current/integrations/endpoint * https://github.com/elastic/protections-artifacts * https://www.elastic.co/security-labs/the-elastic-container-project