Internal GSEC Families
This page tracks internal GSEC_* enums observed in GCIS plugin binaries. These are mostly plugin diagnostics and enforcement events, not always user-facing disconnect codes.
Important Scope Note
GSEC_*values are internal plugin taxonomy.- Not every
GSEC_*is surfaced to the client. - They are still useful for reverse engineering, log triage, and plugin behavior analysis.
Families Observed in Current Snapshot
| Family Prefix | Typical Source | Purpose |
|---|---|---|
GSEC_Common_Error_* / GSEC_Common_Warning_* | Shared GCIS core | Config parse, message parsing, telemetry init, process/token/util failures |
GSEC_ELM_Error_* / GSEC_ELM_Warning_* | ElmPlugin | Event-log monitoring, session lifecycle control, service watcher failures |
GSEC_GCI_Error_* / GSEC_GCI_Warning_* | GciPlugin + Gcp surfaces | GFNMON/masquerade protection, route/registry/driver/file enforcement, message posting |
GSEC_LKM_Error_* | LkmPlugin | App/session orchestration and legacy pipe compatibility failures |
GSEC_UAD_Error_* / GSEC_UAD_Warning_* | UadPlugin | Rule-based anomaly, sysmon/network watcher failures |
GSEC_UADML_Error_* / GSEC_UADML_Warning_* | UadMLPlugin | Feature extraction, perfmon collection, model/inference failures |
GSEC_GSSM_Error_* / GSEC_GSSM_Warning_* | GssmPlugin | Mandatory plugin join/leave guard, session-integrity enforcement |
GSEC_GCP_Error_* | GcpPlugin | Notification mediation and patching/cloud-sync posting paths |
GSEC_GCISH_Error_* | Shared host diagnostics | Diagnostic telemetry and host-side integration errors |
Notable Newer Families
GSSM guard events
GSEC_GSSM_Error_MandatoryPluginsJoinedMessageBusAfterSessionActivationGSEC_GSSM_Error_MandatoryPluginsLeftMessageBusAfterSessionActivationGSEC_GSSM_Error_IntegrityViolationDetectedGSEC_GSSM_Error_SessionAnomalyDetected
GCP mediation events
GSEC_GCI_Error_PostGameStartedMessageFailedGSEC_GCI_Error_PostLkmNotificationFailedGSEC_GCI_Error_FailedToPostOnSeatPatchingMessageGSEC_GCI_Error_MaliciousAppLaunchCommand
UAD/UADML diagnostics
GSEC_UAD_Error_FailedToSubscribeToSysmonEventsGSEC_UAD_Error_DetectedSocketFamilyChangeGSEC_UAD_Error_ProcessExcessiveNetworkActivityErrorGSEC_UADML_Error_PerfmonCollectorNotInitializedGSEC_UADML_Error_UndefinedModelUriInModelConfigurationFile
How To Use This Page
- Use hex +
SRC_*pages first for client-facing disconnect interpretation. - Use
GSEC_*families for deep root-cause work in GCIS plugin logs. - Correlate
GSEC_*entries with plugin-specific logs underC:\Asgard\logs\GCIS\.