Skip to content

Update the Learning Mode network provider GUID #1509

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Richie Gomez (richiemsft) merged 2 commits into from
Oct 15, 2026
Merged

Update the Learning Mode network provider GUID #1509

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d3191a7
Fix manifested network decision provider recognition
richiemsft Oct 15, 2026
b7efba6
Use only the current network decision provider GUID
richiemsft Oct 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions docs/logging-access-denied.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,7 +238,7 @@ sandbox policy:
Feature-enabled Windows builds can add WFP decisions to the managed Learning
Mode ETL through the manifested
`Microsoft-Windows-LearningMode-NetworkDecision` provider
(`{71237669-21C3-4101-BD2F-FF38945D725A}`). MXC accepts event ID `1`,
(`{301EC03D-2951-5EFB-6D99-59C64628BBFC}`). MXC accepts event ID `1`,
`NetworkDecisionV1`, with schema version `1`. The OS Learning Mode broker owns
the WFP subscription, runtime-filter lookup, subject scoping, event
normalization, queue draining, and ETW flush before the trace is sealed.
Expand Down Expand Up @@ -421,7 +421,7 @@ to the redaction, timestamp omission, and bounds described below.
{
"signature": {
"provider": "learningModeNetworkDecision",
"providerGuid": "{71237669-21C3-4101-BD2F-FF38945D725A}",
"providerGuid": "{301EC03D-2951-5EFB-6D99-59C64628BBFC}",
"eventId": 1,
"eventName": "NetworkDecisionV1",
"reason": "actionable",
Expand Down
2 changes: 1 addition & 1 deletion src/mxc-sdk/src/backends/process_container/common/capture_output.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -372,7 +372,7 @@ mod tests {
network_verbose_logging.record_with_byte_budget(
CaptureVerboseLoggingSignature {
provider: CaptureVerboseLoggingProvider::LearningModeNetworkDecision,
provider_guid: "{71237669-21C3-4101-BD2F-FF38945D725A}".to_string(),
provider_guid: "{301EC03D-2951-5EFB-6D99-59C64628BBFC}".to_string(),
event_id: 1,
event_name: Some("NetworkDecisionV1".to_string()),
reason: CaptureVerboseLoggingOutcomeReason::Actionable,
Expand Down
4 changes: 2 additions & 2 deletions src/mxc-sdk/src/core/learning_mode_core/capture_diagnostics.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -838,7 +838,7 @@ mod tests {
) -> CaptureVerboseLoggingSignature {
CaptureVerboseLoggingSignature {
provider: CaptureVerboseLoggingProvider::LearningModeNetworkDecision,
provider_guid: "{71237669-21C3-4101-BD2F-FF38945D725A}".to_string(),
provider_guid: "{301EC03D-2951-5EFB-6D99-59C64628BBFC}".to_string(),
event_id: 1,
event_name: Some("NetworkDecisionV1".to_string()),
reason,
Expand Down Expand Up @@ -982,7 +982,7 @@ mod tests {
"signatures": [{
"signature": {
"provider": "learningModeNetworkDecision",
"providerGuid": "{71237669-21C3-4101-BD2F-FF38945D725A}",
"providerGuid": "{301EC03D-2951-5EFB-6D99-59C64628BBFC}",
"eventId": 1,
"eventName": "NetworkDecisionV1",
"reason": "schemaUnavailable",
Expand Down
8 changes: 4 additions & 4 deletions src/mxc-sdk/src/core/learning_mode_windows/etl_decode.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -480,7 +480,7 @@ impl<'visitor> Accumulator<'visitor> {
let (access_type, resource_type) = analysis.classification;
self.record_capture_signature(CaptureVerboseLoggingSignature {
provider: CaptureVerboseLoggingProvider::LearningModeNetworkDecision,
provider_guid: "{71237669-21C3-4101-BD2F-FF38945D725A}".to_string(),
provider_guid: "{301EC03D-2951-5EFB-6D99-59C64628BBFC}".to_string(),
event_id,
event_name,
reason: analysis.reason,
Expand Down Expand Up @@ -1417,7 +1417,7 @@ mod tests {

#[test]
fn network_decision_is_retained_only_in_unscoped_native_analysis() {
let provider = windows::core::GUID::from_u128(0x71237669_21c3_4101_bd2f_ff38945d725a);
let provider = windows::core::GUID::from_u128(0x301ec03d_2951_5efb_6d99_59c64628bbfc);
assert!(is_learning_mode_event(provider, 1));
for event_id in [0, 2, 14, 28] {
assert!(!is_learning_mode_event(provider, event_id));
Expand Down Expand Up @@ -1448,7 +1448,7 @@ mod tests {
);
assert_eq!(
signature.provider_guid,
"{71237669-21C3-4101-BD2F-FF38945D725A}"
"{301EC03D-2951-5EFB-6D99-59C64628BBFC}"
);
assert_eq!(signature.pid, 0);
assert_eq!(
Expand Down Expand Up @@ -1509,7 +1509,7 @@ mod tests {
fn network_decode_failure_does_not_attribute_the_broker_pid() {
let mut accumulator = Accumulator::analyze();
accumulator.record_event_decode_error(
windows::core::GUID::from_u128(0x71237669_21c3_4101_bd2f_ff38945d725a),
windows::core::GUID::from_u128(0x301ec03d_2951_5efb_6d99_59c64628bbfc),
1,
SCOPED_PID,
tdh_decode::DecodeError::event(
Expand Down
2 changes: 1 addition & 1 deletion src/mxc-sdk/src/core/learning_mode_windows/extractors.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ pub(crate) const PRIVACY_LEARNING_MODE_PROVIDER: GUID = GUID {
};

pub(crate) const NETWORK_DECISION_PROVIDER: GUID =
GUID::from_u128(0x71237669_21c3_4101_bd2f_ff38945d725a);
GUID::from_u128(0x301ec03d_2951_5efb_6d99_59c64628bbfc);
pub(crate) const NETWORK_DECISION_EVENT_ID: u16 = 1;

pub(crate) const ACCESS_CHECK_EVENT_ID: u16 = 14;
Expand Down
8 changes: 4 additions & 4 deletions src/mxc-sdk/src/core/learning_mode_windows/network_extractors.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,10 +16,10 @@ use windows::core::GUID;
use super::extractors::{sanitize_properties, DecodedEventParts, RawDenial};

pub(crate) const NETWORK_DECISION_PROVIDER: GUID = GUID {
data1: 0x7123_7669,
data2: 0x21c3,
data3: 0x4101,
data4: [0xbd, 0x2f, 0xff, 0x38, 0x94, 0x5d, 0x72, 0x5a],
data1: 0x301e_c03d,
data2: 0x2951,
data3: 0x5efb,
data4: [0x6d, 0x99, 0x59, 0xc6, 0x46, 0x28, 0xbb, 0xfc],
};
pub(crate) const NETWORK_DECISION_EVENT_ID: u16 = 1;

Expand Down
4 changes: 2 additions & 2 deletions src/mxc-sdk/src/core/mxc_engine/verbose_telemetry.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,7 +177,7 @@ fn canonical_provider_guid(provider: CaptureVerboseLoggingProvider) -> &'static
"{811A1DDB-2E69-5F25-ADC0-4B186170E760}"
}
CaptureVerboseLoggingProvider::LearningModeNetworkDecision => {
"{71237669-21C3-4101-BD2F-FF38945D725A}"
"{301EC03D-2951-5EFB-6D99-59C64628BBFC}"
}
}
}
Expand Down Expand Up @@ -475,7 +475,7 @@ mod tests {
fn network_provider_uses_the_canonical_guid() {
assert_eq!(
canonical_provider_guid(CaptureVerboseLoggingProvider::LearningModeNetworkDecision),
"{71237669-21C3-4101-BD2F-FF38945D725A}"
"{301EC03D-2951-5EFB-6D99-59C64628BBFC}"
);
}
}
Loading