﻿<?xml version="1.0" encoding="utf-8" standalone='yes'?>

<WindowsPerformanceRecorder Version="1.0" Author="EcoSystem Assessments and Analysis" Team="EcoSystem Assessments and Analysis" Comments="IE" Company="Microsoft Corporation" Copyright="Microsoft Corporation" Tag="FAS">
    <Profiles>
        <!-- System Providers -->

        <SystemProvider Id="SystemProvider_WD_Without_Stacks">
            <Keywords>
                <Keyword Value="CpuConfig" />
                <Keyword Value="Loader" />
                <Keyword Value="ProcessThread" />
                <Keyword Value="HardFaults" />
                <Keyword Value="DiskIO" />
                <Keyword Value="CompactCSwitch" />
                <Keyword Value="CSwitch" />
            </Keywords>
        </SystemProvider>

        <SystemProvider Id="SystemProvider_WD">
            <Keywords>
                <Keyword Value="CpuConfig" />
                <Keyword Value="Loader" />
                <Keyword Value="ProcessThread" />
                <Keyword Value="CompactCSwitch" />
                <Keyword Value="ReadyThread" />
                <Keyword Value="CSwitch" />
                <Keyword Value="FileIO" />
                <Keyword Value="FileIOInit" />
                <Keyword Value="HardFaults" />
                <Keyword Value="DiskIO" />
                <Keyword Value="SampledProfile" />
                <Keyword Value="MemoryInfo" />
                <Keyword Value="MemoryInfoWS" />
                <Keyword Value="Interrupt" />
                <Keyword Value="DPC" />
                <Keyword Value="Registry" />
            </Keywords>
            <Stacks>
                <Stack Value="SampledProfile"/>
                <Stack Value="CSwitch"/>
                <Stack Value="ReadyThread"/>
                <Stack Value="FileCreate"/>
                <Stack Value="FileClose"/>
            </Stacks>
        </SystemProvider>

        <!-- Office Providers -->
        <EventProvider Id="EventProvider_Microsoft_Office" Name="Microsoft-Office-Events" NonPagedMemory="true" Level="4">
            <Keywords>
                <Keyword Value="0x8000000000000004"/>
            </Keywords>
        </EventProvider>

        <!-- Event Providers -->
        <EventProvider Id="EventProvider_Microsoft-Windows-Win32k" Name="Microsoft-Windows-Win32k" NonPagedMemory="true">
            <Keywords>
                <Keyword Value="0x00002000"/>
            </Keywords>
        </EventProvider>

        <!-- Windows Defender providers -->
        <EventProvider Id="EventProvider_AM_Engine" Name="Microsoft-Antimalware-Engine" />
        <EventProvider Id="EventProvider_AM_Service" Name="Microsoft-Antimalware-Service" />
        <EventProvider Id="EventProvider_AM_RTP" Name="Microsoft-Antimalware-RTP" />
        <EventProvider Id="EventProvider_AM_Filter" Name="Microsoft-Antimalware-AMFilter" />
        <EventProvider Id="EventProvider_AM_Protection" Name="Microsoft-Antimalware-Protection" />

        <!-- manifested Process lifetime provider -->
        <EventProvider Id="EventProvider_Windows_Kernel_Process" Name="Microsoft-Windows-Kernel-Process" />

        <!-- AXE provider -->
        <EventProvider Id="EventProvider_Windows_AssessmentExecutionEngine" Name="Microsoft-Windows-AssessmentExecutionEngine"/>

        <!-- Network Providers -->
        <EventProvider Id="EventProvider_Microsoft_Windows_TCPIP" Name="Microsoft-Windows-TCPIP" />
        <EventProvider Id="EventProvider_Microsoft_Windows_WinINet" Name="Microsoft-Windows-WinINet">
            <Keywords>
                <Keyword Value="0x00000000" />
            </Keywords>
        </EventProvider>


        <!-- Profiles -->
        <Profile Id="WD.Light.File" Base="BaseProfile.Light" LoggingMode="File" Name="WD" DetailLevel="Light" Description="WD Timing">
            <Collectors Operation="Add">
                <SystemCollectorId Value="SystemCollector_WPRSystemCollectorInFile">
                    <SystemProviderId Value="SystemProvider_WD_Without_Stacks" />
                </SystemCollectorId>
                <EventCollectorId Value="EventCollector_WPREventCollectorInFile">
                    <EventProviders Operation="Add">

                        <EventProviderId Value="EventProvider_AM_Engine" />
                        <EventProviderId Value="EventProvider_AM_Service" />
                        <EventProviderId Value="EventProvider_AM_RTP" />
                        <EventProviderId Value="EventProvider_AM_Filter" />
                        <EventProviderId Value="EventProvider_AM_Protection" />
                        <EventProviderId Value="EventProvider_Microsoft-Windows-Win32k" />
                        <EventProviderId Value="EventProvider_Windows_Kernel_Process" />
                        <EventProviderId Value="EventProvider_Windows_AssessmentExecutionEngine" />

                        <EventProviderId Value="EventProvider_Microsoft_Windows_TCPIP" />
                        <EventProviderId Value="EventProvider_Microsoft_Windows_WinINet" />
                        <EventProviderId Value="EventProvider_Microsoft_Office" />
                    </EventProviders>
                </EventCollectorId>
            </Collectors>
        </Profile>

        <Profile Id="WD.Light.Memory" Base="BaseProfile.Light" LoggingMode="Memory" Name="WD" DetailLevel="Light" Description="WD Timing">
            <Collectors Operation="Add">
                <SystemCollectorId Value="SystemCollector_WPRSystemCollectorInMemory">
                    <SystemProviderId Value="SystemProvider_WD_Without_Stacks" />
                </SystemCollectorId>
                <EventCollectorId Value="EventCollector_WPREventCollectorInMemoryMedium">
                    <EventProviders Operation="Add">
                        <EventProviderId Value="EventProvider_AM_Engine" />
                        <EventProviderId Value="EventProvider_AM_Service" />
                        <EventProviderId Value="EventProvider_AM_RTP" />
                        <EventProviderId Value="EventProvider_AM_Filter" />
                        <EventProviderId Value="EventProvider_AM_Protection" />
                        <EventProviderId Value="EventProvider_Microsoft-Windows-Win32k" />
                        <EventProviderId Value="EventProvider_Windows_Kernel_Process" />
                        <EventProviderId Value="EventProvider_Windows_AssessmentExecutionEngine" />

                        <EventProviderId Value="EventProvider_Microsoft_Windows_TCPIP" />
                        <EventProviderId Value="EventProvider_Microsoft_Windows_WinINet" />
                        <EventProviderId Value="EventProvider_Microsoft_Office" />
                    </EventProviders>
                </EventCollectorId>
            </Collectors>
        </Profile>

        <Profile Id="WD.Verbose.File" Base="BaseProfile.Light" LoggingMode="File" Name="WD" DetailLevel="Verbose" Description="WD Diagnostic">
            <Collectors Operation="Add">
                <SystemCollectorId Value="SystemCollector_WPRSystemCollectorInFile">
                    <SystemProviderId Value="SystemProvider_WD" />
                </SystemCollectorId>
                <EventCollectorId Value="EventCollector_WPREventCollectorInFile">
                    <EventProviders Operation="Add">
                        <EventProviderId Value="EventProvider_AM_Engine" />
                        <EventProviderId Value="EventProvider_AM_Service" />
                        <EventProviderId Value="EventProvider_AM_RTP" />
                        <EventProviderId Value="EventProvider_AM_Filter" />
                        <EventProviderId Value="EventProvider_AM_Protection" />
                        <EventProviderId Value="EventProvider_Microsoft-Windows-Win32k" />
                        <EventProviderId Value="EventProvider_Windows_Kernel_Process" />
                        <EventProviderId Value="EventProvider_Windows_AssessmentExecutionEngine" />


                        <EventProviderId Value="EventProvider_Microsoft_Windows_TCPIP" />
                        <EventProviderId Value="EventProvider_Microsoft_Windows_WinINet" />
                        <EventProviderId Value="EventProvider_Microsoft_Office" />
                    </EventProviders>
                </EventCollectorId>
            </Collectors>
        </Profile>

        <Profile Id="WD.Verbose.Memory" Base="BaseProfile.Light" LoggingMode="Memory" Name="WD" DetailLevel="Verbose" Description="WD Diagnostic">
            <Collectors Operation="Add">
                <SystemCollectorId Value="SystemCollector_WPRSystemCollectorInMemory">
                    <SystemProviderId Value="SystemProvider_WD" />
                </SystemCollectorId>
                <EventCollectorId Value="EventCollector_WPREventCollectorInMemoryLarge">
                    <EventProviders Operation="Add">
                        <EventProviderId Value="EventProvider_AM_Engine" />
                        <EventProviderId Value="EventProvider_AM_Service" />
                        <EventProviderId Value="EventProvider_AM_RTP" />
                        <EventProviderId Value="EventProvider_AM_Filter" />
                        <EventProviderId Value="EventProvider_AM_Protection" />
                        <EventProviderId Value="EventProvider_Microsoft-Windows-Win32k" />
                        <EventProviderId Value="EventProvider_Windows_Kernel_Process" />
                        <EventProviderId Value="EventProvider_Windows_AssessmentExecutionEngine" />

                        <EventProviderId Value="EventProvider_Microsoft_Windows_TCPIP" />
                        <EventProviderId Value="EventProvider_Microsoft_Windows_WinINet" />
                        <EventProviderId Value="EventProvider_Microsoft_Office" />
                    </EventProviders>
                </EventCollectorId>
            </Collectors>
        </Profile>
    </Profiles>

    <TraceMergeProperties>
        <TraceMergeProperty  Id="Default" Name="Default" Base="">
            <DeletePreMergedTraceFiles Value="true"/>
            <CustomEvents>
                <CustomEvent Value="ImageId"/>
                <CustomEvent Value="BuildInfo"/>
                <CustomEvent Value="VolumeMapping"/>
                <CustomEvent Value="EventMetadata"/>
                <CustomEvent Value="WinSAT"/>
                <CustomEvent Value="NetworkInterface"/>
            </CustomEvents>
        </TraceMergeProperty>
    </TraceMergeProperties>

</WindowsPerformanceRecorder>


