Matt Swann

icon indicating a website link https://swannman.com icon indicating an email [email protected]

icon company @Microsoft icon location Seattle, WA icon location Chief security architect, OneDrive + SharePoint. Passionate about intrusion detection, incident response, and digital forensics.

Results 22 comments of Matt Swann

Add a trace interface to enable ignoring MOF events

@acyr We're happy to merge this pending the feedback above. Are you still working on this?

Why Service Control Manager provider doesn't generate any event id?

Hi @subvert0r, we aren't able to provide general assistance with Windows ETW providers in this repo.