Data sources

FreeDR collects evidence on the local Windows host from six sources. It stores the evidence in a local DuckDB database. In Hunt, everything is queried through the events view, plus the event_log relation for named Windows Event Log fields. Detection rules name the typed source directly (the Rule SQL name column).

Source	Windows mechanism	What it records	event_type values	Rule SQL name / hot table	Key noise controls and dedupe
Process	Kernel process, image and thread ETW (classic kernel providers, FreeDR-Unified session)	Process starts and exits with command line, user, parent and grandparent; image loads	process.start, process.exit, image.load	kernel_process_etw / kernel_process_etw_v6	System32 DLL loads dropped; per-process image dedupe; full image path bound within 2 s
Registry	Microsoft-Windows-Kernel-Registry ETW plus classic registry provider	Successful key create/delete, value set/delete (with data), key security changes	registry.key_created, registry.key_delete, registry.value_set, registry.value_delete, registry.key_security_set	registry_etw / registry_etw_v4	Own process and keys dropped; servicing, app-hive, Edge Update and FeatureManagement noise dropped; identical changes merged within 500 ms
File	Classic kernel FileIo ETW, completed operations only	File creates, writes, renames, deletes, metadata changes, attributed to a process through its thread ID	file.create_open, file.write, file.rename, file.delete, file.set_info	file_etw / file_etw_v5	Own I/O and fixed OS noise paths dropped; ADR-0028 process+path pairs; Defender definition reads; first-only per (process, operation, path) per minute
USN	NTFS USN change journal (FSCTL_READ_USN_JOURNAL) on fixed NTFS volumes	Every file change reason bitmask, with path; durable cursor	usn.change	usn / usn_v3	Close-only records dropped; OS maintenance paths (WinSxS, WindowsApps, Prefetch, …) and ADR-0028 pairs dropped; first-only per (file, reason) per minute
Artifacts	Read-only cooperative file open, WinVerifyTrust	Inventory of files seen by other sources: SHA-256, size, timestamps, PE header, Authenticode verdict and signer, ADS names	artifact.content_version	artifact / artifact_v5 (+ artifact_path_state_v1)	Re-collected only on content change; one pending request per path; 10-minute retry suppression; over 500 MiB not hashed
Windows Event Log (incl. Sysmon)	EvtQuery pull subscriptions on 19 channels, filtered by provider + event ID	Security logons, accounts, groups, audit and log clearing; services; Defender; Task Scheduler; PowerShell; RDP/WinRM/WMI; firewall; AppLocker; Code Integrity; MSI; BITS; PnP; VHD; Sysmon	event_log.* (124 types)	windows_event_log / windows_event_log_v2	Only cataloged provider and event ID pairs are read; FreeDR's own Sysmon events dropped; FreeDR's Sysmon config suppresses events duplicated by native sources

How the sources work together

• Process lineage is shared. The process source keeps a live process and thread table. Registry, file and Event Log rows get actor_* columns from it (image, command line, start time, user).
• File and USN complement each other. File ETW names the process but drops repeats and some paths. USN has no process but resumes from a stored cursor and records every reason bit.
• Artifacts follow the other sources. Process starts, image loads, file changes and USN records queue paths for hashing and signature checks.
• Sysmon is optional extra telemetry, read through the Event Log source. Setup installs it with FreeDR's configuration if it is missing.

Common properties

Property	Detail
Event identity	Every row has a deterministic event_id (UUIDv5 of its content), so replays are not stored twice
Times	occurred_at (when it happened) and written_at (when stored). In events these are epoch microseconds.
Durable cursors	USN and the Event Log commit their position with the evidence. ETW sources are live only and do not replay downtime.
Retention	Hot DuckDB for hot_retention (default 45 min), then cold Parquet until retention_days (default 90). See Storage & health.
Health	Per-collector counters, a degraded flag with a 30-minute hold, and episode counts. See Storage & health.

Not available

Item	Status
Network connections and DNS from native ETW	Not collected natively. Available only through Sysmon events 3 and 22.
File reads, file open-only events	Not collected
Security 4688	Not collected (process ETW covers it)
Registry rename, previous value, failed attempts	Not collected
Prefetch, Amcache, Shimcache, SRUM, autoruns parsers	Roadmap only
Per-source collection policy, editable hot retention, generic aggregation	Listed as future features