diff --git a/PInvoke/Shared/WinNT/CORRELATION_VECTOR.cs b/PInvoke/Shared/WinNT/CORRELATION_VECTOR.cs
new file mode 100644
index 00000000..3f593683
--- /dev/null
+++ b/PInvoke/Shared/WinNT/CORRELATION_VECTOR.cs
@@ -0,0 +1,41 @@
+using System.Runtime.InteropServices;
+
+namespace Vanara.PInvoke
+{
+ /// Store the correlation vector that is used to reference events and the generated logs for diagnostic purposes.
+ // https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/ns-ntddk-correlation_vector typedef struct CORRELATION_VECTOR {
+ // CHAR Version; CHAR Vector[RTL_CORRELATION_VECTOR_STRING_LENGTH]; } CORRELATION_VECTOR;
+ [PInvokeData("ntddk.h", MSDNShortId = "35c1799f-2012-42b0-95e6-6902c818a094")]
+ [StructLayout(LayoutKind.Sequential, Pack = 1)]
+ public struct CORRELATION_VECTOR
+ {
+ ///
+ public const byte RTL_CORRELATION_VECTOR_VERSION_1 = 1;
+
+ ///
+ public const byte RTL_CORRELATION_VECTOR_VERSION_2 = 2;
+
+ ///
+ public const byte RTL_CORRELATION_VECTOR_VERSION_CURRENT = RTL_CORRELATION_VECTOR_VERSION_2;
+
+ ///
+ /// The version of the correlation vector. Possible values are:
+ ///
+ /// -
+ /// RTL_CORRELATION_VECTOR_VERSION_1
+ ///
+ /// -
+ /// RTL_CORRELATION_VECTOR_VERSION_2
+ ///
+ /// -
+ /// RTL_CORRELATION_VECTOR_VERSION_CURRENT
+ ///
+ ///
+ ///
+ public byte Version;
+
+ /// An array CHARs that represents the correlation vector.
+ [MarshalAs(UnmanagedType.ByValArray, SizeConst = 129)]
+ public byte[] Vector;
+ }
+}
\ No newline at end of file