Microsoft-Exchange-ManagedAvailability

41 events across 8 channels

Event	Title	Channel	Sample
1	Message.	Monitoring	N
4	Message.	Monitoring	N
10	Startup notification Id 'NotificationId' inserted.	StartupNotification	N
20	BaseConfig: Identity = PropertiesXml.	ThrottlingConfig	N
21	GlobalOverride: Identity = PropertiesXml.	ThrottlingConfig	N
22	LocalOverride: Identity = PropertiesXml.	ThrottlingConfig	N
23	Effective: Identity = PropertiesXml.	ThrottlingConfig	N
250	Bugcheck action reported by server 'ReportingServer' initiated by responder …	RemoteActionLogs	N
500	Recovery Action Started.	RecoveryActionResults	N
501	Recovery Action Succeeded.	RecoveryActionResults	N
502	Recovery Action Failed.	RecoveryActionResults	N
1000	TypeName-Requester: Arbitration Succeeded.	RecoveryActionLogs	N
1001	TypeName-Requester: Arbitration Failed.	RecoveryActionLogs	N
1010	ActionId-ResourceName-RequesterName: Throttling allowed the operation to …	RecoveryActionLogs	N
1011	ActionId-ResourceName-RequesterName: Throttling rejected the operation.	RecoveryActionLogs	N
1012	ActionId-ResourceName-RequesterName: Throttling is waiting for previous action …	RecoveryActionLogs	N
1020	Starting recovery action (Action=ActionId, Resource=ResourceName, …	RecoveryActionLogs	N
1022	Recovery action succeeded.	RecoveryActionLogs	N
1023	Recovery action failed.	RecoveryActionLogs	N
1024	The 'ResourceName' component was set online.	RecoveryActionLogs	N
1030	Arbitration Quota Info.	RecoveryActionLogs	N
1031	Recovery action 'ActionId' is disabled by registry override (ResourceName: …	RecoveryActionLogs	N
1500	Attempting to kill process.	RecoveryActionLogs	N
1501	Failed to kill the process.	RecoveryActionLogs	N
1502	Successfuly killed the process.	RecoveryActionLogs	N
1503	Activemonitoring encountered an unexpected error.	RecoveryActionLogs	N
1504	Bugcheck is running in a simulated mode.	RecoveryActionLogs	N
1505	Operation completed in Duration.	RecoveryActionLogs	N
2001	InvokeNow request.	InvokeNowRequest	N
2002	InvokeNow definition upload started.	InvokeNowResult	N
2003	InvokeNow definition upload succeeded.	InvokeNowResult	N
2004	InvokeNow definition upload failed.	InvokeNowResult	N
2005	InvokeNow succeeded.	InvokeNowResult	N
2006	InvokeNow failed.	InvokeNowResult	N
2050	ActionId-ResourceName-RequesterName: Throttling allowed the operation to …	RecoveryActionLogs	N
2051	ActionId-ResourceName-RequesterName: Throttling rejected the operation.	RecoveryActionLogs	N
2052	Recovery actions cache successfuly initialized (Elapsed: Elapsed).	RecoveryActionLogs	N
2053	Recovery actions cache failed to initialize (Elapsed: Elapsed).	RecoveryActionLogs	N
2060	Starting service ServiceName without using up throttling quota since the service …	RecoveryActionLogs	N
2061	Attempt start service ServiceName without using up throttling quota failed with …	RecoveryActionLogs	N
2062	Attempt to publish recovery action entry for responder 'RequestorName' failed …	RecoveryActionLogs	N

Event ID 1: Message.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: Monitoring

Description

Message

Fields #

Name	Description
`HealthSet`
`Subject`
`Message`

Event ID 4: Message.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: Monitoring

Description

Message

Fields #

Name	Description
`HealthSet`
`Subject`
`Message`
`Monitor`

Event ID 10: Startup notification Id 'NotificationId' inserted.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: StartupNotification

Description

Startup notification Id 'NotificationId' inserted.

Fields #

Name	Description
`NotificationId`

Event ID 20: BaseConfig: Identity = PropertiesXml.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: ThrottlingConfig

Description

BaseConfig: Identity = PropertiesXml

Fields #

Name	Description
`Identity`
`RecoveryActionId`
`ResponderCategory`
`ResponderTypeName`
`ResponderName`
`ResourceName`
`PropertiesXml`

Event ID 21: GlobalOverride: Identity = PropertiesXml.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: ThrottlingConfig

Description

GlobalOverride: Identity = PropertiesXml

Fields #

Name	Description
`Identity`
`RecoveryActionId`
`ResponderCategory`
`ResponderTypeName`
`ResponderName`
`ResourceName`
`PropertiesXml`

Event ID 22: LocalOverride: Identity = PropertiesXml.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: ThrottlingConfig

Description

LocalOverride: Identity = PropertiesXml

Fields #

Name	Description
`Identity`
`RecoveryActionId`
`ResponderCategory`
`ResponderTypeName`
`ResponderName`
`ResourceName`
`PropertiesXml`

Event ID 23: Effective: Identity = PropertiesXml.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: ThrottlingConfig

Description

Effective: Identity = PropertiesXml

Fields #

Name	Description
`Identity`
`RecoveryActionId`
`ResponderCategory`
`ResponderTypeName`
`ResponderName`
`ResourceName`
`PropertiesXml`

Event ID 250: Bugcheck action reported by server 'ReportingServer' initiated by responder 'RequesterName'.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RemoteActionLogs

Description

Bugcheck action reported by server 'ReportingServer' initiated by responder 'RequesterName'

Fields #

Name	Description
`ReportingServer`
`ActionId`
`RequesterName`
`Context`
`TimeStamp`

Event ID 500: Recovery Action Started.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionResults

Description

Recovery Action Started. (ActionId=Id, ResourceName=ResourceName, Requester=RequestorName, InstanceId=InstanceId, ExpectedToFinishAt=EndTime

Fields #

Name	Description
`Id`
`InstanceId`
`ResourceName`
`StartTime`
`EndTime`
`State`
`Result`
`RequestorName`
`ExceptionName`
`ExceptionMessage`
`Context`
`CustomArg1`
`CustomArg2`
`CustomArg3`
`LamProcessStartTime`
`ThrottleIdentity`
`ThrottleParametersXml`
`TotalLocalActionsInOneHour`
`TotalLocalActionsInOneDay`
`TotalGroupActionsInOneDay`

Event ID 501: Recovery Action Succeeded.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionResults

Description

Recovery Action Succeeded. (ActionId=Id, ResourceName=ResourceName, Requester=RequestorName, InstanceId=InstanceId, ActualStartTime=StartTime, ActualEndTime=EndTime)

Fields #

Name	Description
`Id`
`InstanceId`
`ResourceName`
`StartTime`
`EndTime`
`State`
`Result`
`RequestorName`
`ExceptionName`
`ExceptionMessage`
`Context`
`CustomArg1`
`CustomArg2`
`CustomArg3`
`LamProcessStartTime`
`ThrottleIdentity`
`ThrottleParametersXml`
`TotalLocalActionsInOneHour`
`TotalLocalActionsInOneDay`
`TotalGroupActionsInOneDay`

Event ID 502: Recovery Action Failed.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionResults

Description

Recovery Action Failed. (ActionId=Id, ResourceName=ResourceName, Requester=RequestorName, InstanceId=InstanceId, ActualStartTime=StartTime, ActualEndTime=EndTime, ErrorMessage=ExceptionMessage)

Fields #

Name	Description
`Id`
`InstanceId`
`ResourceName`
`StartTime`
`EndTime`
`State`
`Result`
`RequestorName`
`ExceptionName`
`ExceptionMessage`
`Context`
`CustomArg1`
`CustomArg2`
`CustomArg3`
`LamProcessStartTime`
`ThrottleIdentity`
`ThrottleParametersXml`
`TotalLocalActionsInOneHour`
`TotalLocalActionsInOneDay`
`TotalGroupActionsInOneDay`

Event ID 1000: TypeName-Requester: Arbitration Succeeded.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

TypeName-Requester: Arbitration Succeeded (TotalRequests: TotalRequested, TotalReady: TotalReady, TotalOffline: TotalOffline, TotalArbitrating: TotalInArbitration, MinimumReadyRequired: MinimumRequiredRead MaximumBusyAllowed: MaximumAllowedBusy)

Fields #

Name	Description
`TypeName`
`Requester`
`TotalRequested`
`TotalReady`
`TotalInArbitration`
`TotalMaintenance`
`TotalUnknown`
`MinimumRequiredRead`
`MaximumAllowedBusy`
`ReadyResources`
`ArbitratingResource`
`InMaintenanceResources`
`UnknownResources`
`Message`
`TotalOffline`
`OfflineResources`

Event ID 1001: TypeName-Requester: Arbitration Failed.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

TypeName-Requester: Arbitration Failed (TotalRequests: TotalRequested, TotalReady: TotalReady, TotalOffline: TotalOffline, TotalArbitrating: TotalInArbitration, MinimumReadyRequired: MinimumRequiredRead, MaximumBusyAllowed: MaximumAllowedBusy, Error: Message)

Fields #

Name	Description
`TypeName`
`Requester`
`TotalRequested`
`TotalReady`
`TotalInArbitration`
`TotalMaintenance`
`TotalUnknown`
`MinimumRequiredRead`
`MaximumAllowedBusy`
`ReadyResources`
`ArbitratingResource`
`InMaintenanceResources`
`UnknownResources`
`Message`
`TotalOffline`
`OfflineResources`

Event ID 1010: ActionId-ResourceName-RequesterName: Throttling allowed the operation to execute.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

ActionId-ResourceName-RequesterName: Throttling allowed the operation to execute

Fields #

Name	Description
`ActionId`
`ResourceName`
`RequesterName`
`LowestQueryTime`
`IsMinimumSecondsCheckPassed`
`MinmumSecondsCheckStartTime`
`ConfiguredMinimumSecondsBetweenAttempts`
`IsMaximumInHourCheckPassed`
`MaximumInHourCheckStartTime`
`AttempstInHourCount`
`ConfiguredMaximumAllowedAttemptsInAnHour`
`IsMaximumInDayCheckPassed`
`MaximumInDayCheckStartTime`
`AttempstInDayCount`
`ConfiguredMaximumAllowedAttemptsInAnDay`

Event ID 1011: ActionId-ResourceName-RequesterName: Throttling rejected the operation.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

ActionId-ResourceName-RequesterName: Throttling rejected the operation

Fields #

Name	Description
`ActionId`
`ResourceName`
`RequesterName`
`LowestQueryTime`
`IsMinimumSecondsCheckPassed`
`MinmumSecondsCheckStartTime`
`ConfiguredMinimumSecondsBetweenAttempts`
`IsMaximumInHourCheckPassed`
`MaximumInHourCheckStartTime`
`AttempstInHourCount`
`ConfiguredMaximumAllowedAttemptsInAnHour`
`IsMaximumInDayCheckPassed`
`MaximumInDayCheckStartTime`
`AttempstInDayCount`
`ConfiguredMaximumAllowedAttemptsInAnDay`

Event ID 1012: ActionId-ResourceName-RequesterName: Throttling is waiting for previous action to complete (Pening => Requester: PreviousRequesterName, StartTime: PreviousStartTime, ExpectedToEndBefore: ExpectedTo...

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

ActionId-ResourceName-RequesterName: Throttling is waiting for previous action to complete (Pening => Requester: PreviousRequesterName, StartTime: PreviousStartTime, ExpectedToEndBefore: ExpectedToEndBefore)

Fields #

Name	Description
`ActionId`
`ResourceName`
`RequesterName`
`PreviousRequesterName`
`PreviousStartTime`
`ExpectedToEndBefore`

Event ID 1020: Starting recovery action (Action=ActionId, Resource=ResourceName, Requester=RequesterName, ThrottlingMode=ThrottlingMode).

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

Starting recovery action (Action=ActionId, Resource=ResourceName, Requester=RequesterName, ThrottlingMode=ThrottlingMode)

Fields #

Name	Description
`ActionId`
`ResourceName`
`RequesterName`
`ThrottlingMode`

Event ID 1022: Recovery action succeeded.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

Recovery action succeeded. (Action=ActionId, Resource=ResourceName, Requester=RequesterName)

Fields #

Name	Description
`ActionId`
`ResourceName`
`RequesterName`
`Exception`
`ThrottleIdentity`
`ThrottleParameters`

Event ID 1023: Recovery action failed.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

Recovery action failed. (Action=ActionId, Resource=ResourceName, Requester=RequesterName, Error=Exception)

Fields #

Name	Description
`ActionId`
`ResourceName`
`RequesterName`
`Exception`
`ThrottleIdentity`
`ThrottleParameters`

Event ID 1024: The 'ResourceName' component was set online.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

The 'ResourceName' component was set online. (Action=ActionId, Resource=ResourceName, Requester=RequesterName)

Fields #

Name	Description
`ActionId`
`ResourceName`
`RequesterName`
`Exception`
`ThrottleIdentity`
`ThrottleParameters`

Event ID 1030: Arbitration Quota Info.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

Arbitration Quota Info (TypeName: TypeName, IsQuotaComputationConcluded: IsQuotaComputationConcluded, IsQuotaExhausted: IsQuotaExhausted, IsActionAttemptedBeforeMinimumTime: IsActionAttemptedBeforeMinimumTime, TotalQuotaExhaustedAcrossGroup: TotalQuotaExhaustedAcrossGroup, MaximumAllowedTotalActionsAcrossGroup: MaximumAllowedTotalActionsAcrossGroup)

Fields #

Name	Description
`TypeName`
`IsQuotaComputationConcluded`
`IsQuotaExhausted`
`IsActionAttemptedBeforeMinimumTime`
`TotalQuotaExhaustedAcrossGroup`
`MaximumAllowedTotalActionsAcrossGroup`

Event ID 1031: Recovery action 'ActionId' is disabled by registry override (ResourceName: ResourceName, RequesterName: RequesterName).

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

Recovery action 'ActionId' is disabled by registry override (ResourceName: ResourceName, RequesterName: RequesterName)

Fields #

Name	Description
`ActionId`
`ResourceName`
`RequesterName`

Event ID 1500: Attempting to kill process.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

Attempting to kill process. (Id=ProcessId, Name=ProcessName, IsChild=IsChildProcess, Context=Context)

Fields #

Name	Description
`ProcessId`
`ProcessName`
`IsChildProcess`
`Context`

Event ID 1501: Failed to kill the process.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

Failed to kill the process. (Id=ProcessId, Name=ProcessName, IsChild=IsChildProcess, Context=Context, Error=Error)

Fields #

Name	Description
`ProcessId`
`ProcessName`
`IsChildProcess`
`Context`
`Error`

Event ID 1502: Successfuly killed the process.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

Successfuly killed the process. (Id=ProcessId, Name=ProcessName, IsChild=IsChildProcess, Context=Context)

Fields #

Name	Description
`ProcessId`
`ProcessName`
`IsChildProcess`
`Context`

Event ID 1503: Activemonitoring encountered an unexpected error.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

Activemonitoring encountered an unexpected error. (Reason: InitiatedBy, Error: Error).

Fields #

Name	Description
`InitiatedBy`
`Error`

Event ID 1504: Bugcheck is running in a simulated mode.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

Bugcheck is running in a simulated mode. (Duration: Duration, IsOneShot: IsOneShot, SimlatedBootTime: SimlatedBootTime, IsExitProcess: IsExitProcess)

Fields #

Name	Description
`Duration`
`IsOneShot`
`SimlatedBootTime`
`IsExitProcess`

Event ID 1505: Operation completed in Duration.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

Operation completed in Duration. (ReturnHint=ReturnHint, Error=Error)

Fields #

Name	Description
`Operation`
`Duration`
`ReturnHint`
`Error`

Event ID 2001: InvokeNow request.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: InvokeNowRequest

Description

InvokeNow request.

Fields #

Name	Description
`Id`
`TypeName`
`AssemblyPath`
`PropertyBag`
`MonitorIdentity`
`ExtensionAttributes`
`RequestTime`
`State`
`Result`
`ErrorMessage`
`WorkDefinitionId`

Event ID 2002: InvokeNow definition upload started.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: InvokeNowResult

Description

InvokeNow definition upload started.

Fields #

Name	Description
`Id`
`TypeName`
`AssemblyPath`
`PropertyBag`
`MonitorIdentity`
`ExtensionAttributes`
`RequestTime`
`State`
`Result`
`ErrorMessage`
`WorkDefinitionId`

Event ID 2003: InvokeNow definition upload succeeded.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: InvokeNowResult

Description

InvokeNow definition upload succeeded

Fields #

Name	Description
`Id`
`TypeName`
`AssemblyPath`
`PropertyBag`
`MonitorIdentity`
`ExtensionAttributes`
`RequestTime`
`State`
`Result`
`ErrorMessage`
`WorkDefinitionId`

Event ID 2004: InvokeNow definition upload failed.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: InvokeNowResult

Description

InvokeNow definition upload failed.

Fields #

Name	Description
`Id`
`TypeName`
`AssemblyPath`
`PropertyBag`
`MonitorIdentity`
`ExtensionAttributes`
`RequestTime`
`State`
`Result`
`ErrorMessage`
`WorkDefinitionId`

Event ID 2005: InvokeNow succeeded.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: InvokeNowResult

Description

InvokeNow succeeded.

Fields #

Name	Description
`Id`
`TypeName`
`AssemblyPath`
`PropertyBag`
`MonitorIdentity`
`ExtensionAttributes`
`RequestTime`
`State`
`Result`
`ErrorMessage`
`WorkDefinitionId`

Event ID 2006: InvokeNow failed.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: InvokeNowResult

Description

InvokeNow failed.

Fields #

Name	Description
`Id`
`TypeName`
`AssemblyPath`
`PropertyBag`
`MonitorIdentity`
`ExtensionAttributes`
`RequestTime`
`State`
`Result`
`ErrorMessage`
`WorkDefinitionId`

Event ID 2050: ActionId-ResourceName-RequesterName: Throttling allowed the operation to execute.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

ActionId-ResourceName-RequesterName: Throttling allowed the operation to execute

Fields #

Name	Description
`InstanceId`
`ActionId`
`ResourceName`
`RequesterName`
`ExceptionMessage`
`LocalThrottleResult`
`GroupThrottleResult`
`TotalServersInGroup`
`TotalServersInCompatibleVersion`

Event ID 2051: ActionId-ResourceName-RequesterName: Throttling rejected the operation.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

ActionId-ResourceName-RequesterName: Throttling rejected the operation

Fields #

Name	Description
`InstanceId`
`ActionId`
`ResourceName`
`RequesterName`
`ExceptionMessage`
`LocalThrottleResult`
`GroupThrottleResult`
`TotalServersInGroup`
`TotalServersInCompatibleVersion`

Event ID 2052: Recovery actions cache successfuly initialized (Elapsed: Elapsed).

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

Recovery actions cache successfuly initialized (Elapsed: Elapsed)

Fields #

Name	Description
`Elapsed`
`EntriesCount`
`FromTime`
`ToTime`
`Timeout`
`Exception`

Event ID 2053: Recovery actions cache failed to initialize (Elapsed: Elapsed).

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

Recovery actions cache failed to initialize (Elapsed: Elapsed)

Fields #

Name	Description
`Elapsed`
`EntriesCount`
`FromTime`
`ToTime`
`Timeout`
`Exception`

Event ID 2060: Starting service ServiceName without using up throttling quota since the service is already stopped.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

Starting service ServiceName without using up throttling quota since the service is already stopped

Fields #

Name	Description
`ServiceName`

Event ID 2061: Attempt start service ServiceName without using up throttling quota failed with Error.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

Attempt start service ServiceName without using up throttling quota failed with Error.

Fields #

Name	Description
`ServiceName`
`Error`

Event ID 2062: Attempt to publish recovery action entry for responder 'RequestorName' failed with error: ErrorMessage.

Provider: Microsoft-Exchange-ManagedAvailability
Channel: RecoveryActionLogs

Description

Attempt to publish recovery action entry for responder 'RequestorName' failed with error: ErrorMessage.

Fields #

Name	Description
`Id`
`InstanceId`
`ResourceName`
`RequestorName`
`ErrorMessage`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)