.search-container{position:relative;margin-bottom:.5em}.search-input-wrap{position:relative;display:flex;align-items:center}.search-icon{position:absolute;left:.75em;width:1.1em;height:1.1em;color:var(--fg2);pointer-events:none}.search-input-placeholder{position:absolute;left:2.6em;right:2.6em;top:50%;transform:translateY(-50%);pointer-events:none;color:var(--fg2);font-size:1rem;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;opacity:1}.search-input-placeholder kbd{display:inline-block;padding:.05em .4em;font-family:var(--font-mono,monospace);font-size:.85rem;border:1px solid var(--border);border-radius:3px;background:var(--bg2);color:var(--fg1)}#event-search:focus ~ .search-input-placeholder,#event-search:not(:placeholder-shown) ~ .search-input-placeholder,.search-input-wrap--has-value .search-input-placeholder{opacity:0}.search-input{width:100%;padding:.75em 1em .75em 2.5em;font-size:1rem;font-family:inherit;background:var(--bg2);color:var(--fg1);border:1px solid var(--border);border-radius:4px;outline:0;box-sizing:border-box}.search-input:focus{border-color:var(--link);box-shadow:0 0 0 2px color-mix(in srgb,var(--link) 30%,transparent)}.search-input::placeholder{color:var(--fg2)}.search-status{position:absolute;right:2.75em;font-size:.8rem;color:var(--fg2);pointer-events:none;white-space:nowrap}.search-explain{min-height:1.45em;margin-top:.45em;font-size:.85rem;color:var(--fg2)}.search-explain:empty{min-height:0;margin-top:0}html.search-restored-pristine .search-explain{display:none}.search-explain code{color:var(--fg1)}.search-explain-warn{display:block;color:var(--msg-param)}.search-explain-tok{text-decoration:underline dotted;text-underline-offset:.2em}.search-explain-fix{all:unset;cursor:pointer;font:inherit;color:var(--link);pointer-events:auto}.search-explain-fix:hover,.search-explain-fix:focus-visible{text-decoration:underline}.search-explain-fix:focus-visible{outline:2px solid var(--link);outline-offset:2px}.search-explain-fix code{color:inherit}.search-filters{display:flex;flex-wrap:wrap;gap:.5em;margin-top:1em;align-items:center}.search-explain:not(:empty) ~ .search-filters{margin-top:.5em}.filter-select{display:inline-flex;align-items:center;padding:.3em .6em;font-size:.8rem;font-family:inherit;line-height:1.4;border-radius:3px;border:1px solid var(--border);background:var(--bg2);color:var(--fg1);cursor:pointer;white-space:nowrap;transition:background .15s,border-color .15s,color .15s}.filter-select:hover{background:var(--bg3)}.filter-select:focus{outline:0;border-color:color-mix(in srgb,var(--link) 50%,var(--border))}.filter-select:not(:has(option[value=""]:checked)):not(:focus){background:color-mix(in srgb,#3b82f6 15%,var(--bg2));border-color:color-mix(in srgb,#3b82f6 40%,var(--border))}.filter-more{position:relative;display:inline-block}.filter-more>.filter-more-summary{list-style:none;cursor:pointer}.filter-more>.filter-more-summary::-webkit-details-marker{display:none}.filter-more>.filter-more-summary::after{content:" \25BE";opacity:.6}.filter-more[open]>.filter-more-summary{background:color-mix(in srgb,#3b82f6 10%,var(--bg2))}.filter-more-panel{position:absolute;top:calc(100% + 4px);left:0;z-index:10;display:flex;flex-direction:column;gap:.4em;min-width:12em;padding:.75em;background:var(--bg1);border:1px solid var(--border);border-radius:4px;box-shadow:0 4px 12px rgba(0,0,0,0.15)}.filter-more-panel .filter-flag{display:flex;align-items:center;justify-content:space-between;gap:.75em;font-size:.85rem;white-space:nowrap}.filter-more-panel .filter-flag:hover{color:var(--link)}.filter-flag-select{font-size:.85rem;font-family:inherit;padding:.15em .35em;border-radius:3px;border:1px solid var(--border);background:var(--bg2);color:var(--fg1);cursor:pointer}.search-suggest{position:absolute;top:calc(100% + 4px + var(--dw-explain-h, 0px));left:0;right:0;z-index:30;max-height:min(50vh,18rem);overflow-y:auto;-webkit-overflow-scrolling:touch;background:var(--bg1);border:1px solid var(--border);border-radius:4px;box-shadow:0 4px 12px rgba(0,0,0,0.15)}.search-suggest[hidden]{display:none}.search-suggest-row{display:flex;align-items:baseline;gap:1em;padding:.4em .75em;font-size:.85rem;cursor:pointer}.search-suggest-row:hover,.search-suggest-row--active{background:var(--bg3)}.search-suggest-label{flex:0 1 auto;min-width:0;font-family:var(--font-mono,monospace);color:var(--fg1);white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.search-suggest-gloss{flex:1 1 auto;min-width:0;text-align:right;color:var(--fg2);white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.search-suggest-hint{padding:.5em .75em;font-size:.8rem;color:var(--fg2)}@media(max-width:600px){.search-suggest-gloss{display:none}.filter-more-panel{left:auto;right:0;max-width:calc(100vw - 2rem)}}.search-start{position:absolute;top:calc(100% + 4px + var(--dw-explain-h, 0px));left:0;right:0;z-index:30;max-height:min(60vh,26rem);overflow-y:auto;-webkit-overflow-scrolling:touch;background:var(--bg1);border:1px solid var(--border);border-radius:4px;box-shadow:0 4px 12px rgba(0,0,0,0.15);padding:.75em}.search-start[hidden]{display:none}.search-start-recent{margin-bottom:.75em;padding-bottom:.6em;border-bottom:1px solid var(--border)}.search-start-recent-header{display:flex;justify-content:space-between;align-items:center;font-size:.75rem;color:var(--fg2);margin-bottom:.3em}.search-start-recent-clear{background:0;border:0;padding:0;cursor:pointer;color:var(--fg2);font-size:.75rem}.search-start-recent-clear:hover{color:var(--fg1)}.search-start-recent-item{display:block;width:100%;text-align:left;background:0;border:0;padding:.3em .4em;font-size:.82rem;font-family:var(--font-mono,monospace);color:var(--fg1);cursor:pointer;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.search-start-recent-item:hover,.search-start-recent-item:focus-visible{background:var(--bg3)}.search-start-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(14rem,1fr));gap:1em}.search-start-col h4{margin:0 0 .4em;font-size:.8rem;font-weight:600;color:var(--fg2)}.search-start-col ul{list-style:none;margin:0;padding:0}.search-start-item{display:block;width:100%;text-align:left;background:0;border:0;padding:.35em .4em;cursor:pointer;border-radius:3px}.search-start-item:hover,.search-start-item:focus-visible{background:var(--bg3)}.search-start-q{display:block;font-size:.82rem;color:var(--fg1)}.search-start-code{display:block;margin-top:.15em;font-size:.78rem;font-family:var(--font-mono,monospace);color:var(--link);overflow-wrap:anywhere}.search-start-foot{margin-top:.5em;padding-top:.5em;border-top:1px solid var(--border);font-size:.78rem;text-align:right}@media(max-width:600px){.search-start-grid{grid-template-columns:1fr}}.search-noscript{margin:.5em 0 0;padding:.5em .75em;font-size:.8rem;color:var(--fg2);background:var(--bg2);border:1px solid var(--border);border-radius:4px}.search-clear{position:absolute;right:.5em;top:50%;transform:translateY(-50%);background:0;border:0;color:var(--fg2);font-size:1.3rem;cursor:pointer;padding:.25em;line-height:1;align-items:center;z-index:1}.search-clear:not([hidden]){display:flex}.search-clear:hover{color:var(--fg1)}.search-results-table{overflow-x:auto;-webkit-overflow-scrolling:touch}.search-results-surface{display:none}html.search-landing .search-results-surface,html.search-active .search-results-surface{display:block;min-height:min(42rem,65vh)}html.search-landing #catalogs,html.search-active #catalogs,html.search-landing .home-directory,html.search-active .home-directory,html.search-landing .event-catalog>.table-scroll-wrap,html.search-active .event-catalog>.table-scroll-wrap,html.search-landing .event-catalog>.provider-overflow,html.search-active .event-catalog>.provider-overflow{display:none}@media(max-width:600px){html.search-landing .search-results-surface,html.search-active .search-results-surface{min-height:min(34rem,62vh)}}.search-card-expand,.search-card-more-btn{display:inline-block;margin-top:.4em;background:transparent;color:var(--fg2);border:1px solid var(--border);border-radius:3px;padding:.15em .55em;font-size:.75rem;cursor:pointer;font-family:inherit}.search-card-expand:hover,.search-card-more-btn:hover{background:var(--bg3);color:var(--fg1)}.search-card-expanded{margin-top:.5em;padding:.5em .75em;background:var(--bg2);border-radius:3px;border-left:2px solid var(--border);max-height:60vh;overflow-y:auto}.search-card-expanded .rule-section{margin:.5rem 0}.search-card-expanded .rule-section h2{font-size:.95rem;border-bottom:1px solid var(--border);margin-bottom:.3rem;padding-bottom:.2rem}.search-card-expanded-loading{margin:0;font-size:.85rem;color:var(--fg2)}.search-result-toolbar{display:flex;justify-content:flex-end;gap:.4em;padding:0 0 .5em}.search-result-copy,.search-result-density{background:var(--bg2);color:var(--fg2);border:1px solid var(--border);border-radius:3px;padding:.2em .6em;font-size:.75rem;cursor:pointer;font-family:inherit}.search-result-copy:hover:not(:disabled),.search-result-density:hover{background:var(--bg3);color:var(--fg1)}.search-result-copy:disabled{cursor:default;opacity:.7}.search-result-density{margin-right:auto}.search-cards--compact .search-card{padding:.4em .65em}.search-cards--compact .search-card-context,.search-cards--compact .search-card-techniques,.search-cards--compact .search-card-thirdline,.search-cards--compact .search-card-indicators,.search-cards--compact .search-card-expand,.search-cards--compact .search-card-expanded,.search-cards--compact .search-card-more-btn,.search-cards--compact .search-card-more-panel{display:none}.search-cards--compact .search-card-primary{margin:0}.search-pagination{display:flex;align-items:center;justify-content:center;gap:.25em;margin-top:1em;padding:.5em 0}.search-pagination .page-btn{min-width:2em;padding:.3em .5em;border:1px solid var(--border);border-radius:3px;background:var(--bg2);color:var(--fg1);font-size:.85rem;font-family:inherit;cursor:pointer;text-align:center}.search-pagination .page-btn:hover:not(:disabled){background:var(--bg3)}.search-pagination .page-btn--active{background:var(--link);color:var(--badge-fg);border-color:var(--link)}.search-pagination .page-btn:disabled{opacity:.4;cursor:default}.search-pagination .page-ellipsis{padding:.3em .25em;color:var(--fg2)}.search-pagination .page-summary{font-size:.8rem;color:var(--fg2);margin-left:1em}.search-cards{display:flex;flex-direction:column;gap:2px}.search-card{display:block;padding:.6em .75em;border-bottom:1px solid var(--border);cursor:pointer;transition:background .1s}.search-card:hover,.search-card--active{background:var(--bg3)}.search-card--rule{border-left:3px solid var(--fg2)}.search-card--indicator{border-left:3px solid var(--indicator-accent)}.search-card-indicator-value{font-weight:600}.search-card-ws{color:var(--fg2)}.search-card-rule-link{display:block;padding:.25em .5em .25em .6em;margin:.2em 0;border-left:2px solid var(--fg2);font-size:.85rem;color:var(--fg1);text-decoration:none}.search-card-rule-link:hover{background:var(--bg2)}.search-card-rule-link[href^="/rules/sigma/"]{border-left-color:#3b82f6}.search-card-rule-link[href^="/rules/sigma/"] .search-card-vendor{color:#3b82f6}.search-card-rule-link[href^="/rules/elastic/"]{border-left-color:#f97316}.search-card-rule-link[href^="/rules/elastic/"] .search-card-vendor{color:#f97316}.search-card-rule-link[href^="/rules/splunk/"]{border-left-color:#22c55e}.search-card-rule-link[href^="/rules/splunk/"] .search-card-vendor{color:#22c55e}.search-card-rule-link[href^="/rules/kusto/"]{border-left-color:#a855f7}.search-card-rule-link[href^="/rules/kusto/"] .search-card-vendor{color:#a855f7}.search-card-rule-link[href^="/rules/chronicle/"]{border-left-color:#ef4444}.search-card-rule-link[href^="/rules/chronicle/"] .search-card-vendor{color:#ef4444}.search-card-rule-link[href^="/rules/panther/"]{border-left-color:#eab308}.search-card-rule-link[href^="/rules/panther/"] .search-card-vendor{color:#eab308}.search-card-rule-link[href^="/rules/falco/"]{border-left-color:#06b6d4}.search-card-rule-link[href^="/rules/falco/"] .search-card-vendor{color:#06b6d4}.search-card-rule-link[href^="/rules/mql/"]{border-left-color:#ec4899}.search-card-rule-link[href^="/rules/mql/"] .search-card-vendor{color:#ec4899}.search-card-type{display:inline-block;font-size:.65rem;font-weight:600;letter-spacing:.05em;text-transform:uppercase;color:var(--fg2);margin-right:.5em;opacity:.6;min-width:4.5em}.search-card-vendor{font-weight:600;font-size:.85rem}.search-card-technique{display:inline-block;font-size:.78rem;padding:.1em .4em;border-radius:2px;background:var(--bg3);margin-right:.35em;margin-bottom:.15em;color:var(--fg1)}.search-card-technique code{font-weight:600;font-size:.75rem;color:var(--link);margin-right:.25em}.search-card-techniques{display:flex;flex-wrap:wrap}.search-card-thirdline{font-size:.85rem;color:var(--fg2);display:flex;flex-direction:column;gap:.35em}.search-card-indicators{font-size:.78rem;color:var(--fg2);display:flex;flex-direction:column;gap:.15em;margin-top:.3em;padding-left:.7em;border-left:2px solid var(--border)}.search-card-indicator-line code{background:var(--bg3);padding:0 .25em;border-radius:2px;font-size:.92em;color:var(--fg1)}.search-card-indicator-line em,.search-card-indicator-kind{font-style:normal;color:var(--fg2);font-size:.9em;padding:0 .15em}.search-card-group-header{font-size:.95rem;margin:1.25em 0 .5em;color:var(--fg1);border-bottom:1px solid var(--border);padding-bottom:.3em}.search-card-group-header:first-child{margin-top:.25em}.search-card-group-count{color:var(--fg2);font-weight:normal;font-size:.85em}.search-card-indicator-kind--regex_match{color:#dc2626}.search-card-indicator-kind--cidr_match{color:#2563eb}.search-card-indicator-kind--eq,.search-card-indicator-kind--in{color:#16a34a}.search-card-indicator-kind--starts_with,.search-card-indicator-kind--ends_with{color:#ea580c}.search-card-indicator-kind--wildcard,.search-card-indicator-kind--match,.search-card-indicator-kind--contains{color:var(--link)}.search-card-indicator-kind--ne{color:#9333ea}.search-card-rule-desc{display:block}.search-card-badge-row{display:flex;flex-wrap:wrap;gap:.4em;align-items:baseline}.search-card-badge{display:inline-block;font-size:.7rem;padding:.05em .4em;border-radius:3px;background:var(--bg3);color:var(--fg1);white-space:nowrap}.search-card-badge--sev-critical{background:color-mix(in srgb,#dc2626 25%,var(--bg2))}.search-card-badge--sev-high{background:color-mix(in srgb,#ea580c 22%,var(--bg2))}.search-card-badge--sev-medium{background:color-mix(in srgb,#ca8a04 22%,var(--bg2))}.search-card-badge--sev-low{background:color-mix(in srgb,#2563eb 18%,var(--bg2))}.search-card-badge--sev-informational{background:var(--bg3)}.search-card--provider{border-left:3px solid var(--link);padding-left:calc(0.75em - 3px)}.search-card--provider .search-card-provider{color:var(--link);font-size:.95rem;font-weight:600}.search-card-primary{font-size:.95rem;line-height:1.4}.search-card-provider{color:var(--fg2);font-size:.85rem}.search-card-separator{color:var(--fg2);font-size:.85rem;margin:0 .15em}.search-card-id{color:var(--link);font-weight:600}.search-card-desc{color:var(--fg1)}.search-card-context{margin-top:.3em;padding-left:1em;font-size:.85rem;color:var(--fg2);line-height:1.5;overflow:hidden;text-overflow:ellipsis}.search-card-section{font-weight:600;color:var(--fg2);font-size:.8rem;text-transform:uppercase;letter-spacing:.03em}.filter-detail-item{display:block;margin-top:.15em;padding-left:1em;text-indent:-1em}.filter-detail-item:first-of-type{margin-top:0}.filter-detail-item code{color:var(--link);font-size:.85rem;padding:0;background:0}