Microsoft-Windows-AppXDeployment-Server-UndockedDeh

16 events across 1 channel

Event	Title	Channel	Sample
9000	Installing EventLog manifest for package: 'PackageFullName' (See 'Details' for …	Operational	Y
9001	Uninstalling EventLog manifest for package: 'PackageFullName' (See 'Details' for …	Operational	Y
9002	Installed EventLog manifest for package: 'PackageFullName' (See 'Details' for …	Operational	Y
9003	Uninstalled EventLog manifest for package: 'PackageFullName' (See 'Details' for …	Operational	Y
9004	Setting active EventLog manifest for package: 'PackageFullName' (See 'Details' …	Operational	N
9005	Unsetting active EventLog manifest for package: 'PackageFullName' (See 'Details' …	Operational	Y
10001	Loading registration table for Undocked DEH dll: DllName, Path: DllPath, Phase: …	Operational	N
10002	Evaluating request for DEH: DEH 'DehName' in Phase 'DehPhase'.	Operational	Y
10003	StringAddEntryEvent: StringAddEntryEvent.	Operational	N
10004	Failed performing DEH request: Action 'DehAction' in DEH 'DehName' in Phase …	Operational	N
10005	Failed performing operation on entry: Operation 'Operation' on Entry 'EntryName' …	Operational	N
10006	Encountered package pair in DEH package evaluation: DEH 'DehName' in Phase …	Operational	N
10007	Encountered package in DEH package evaluation: Direction 'Direction', DEH …	Operational	Y
10008	Failure working on items: Item count 'ItemCounter', Current item name …	Operational	N
10009	Failure working on item: Item 'ItemName', Step counter 'StepCounter'.	Operational	N
10010	Failure at frame: File 'File', Line 'Line' (See 'Details' for extended …	Operational	N

Event ID 9000: Installing EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Provider: Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel: Operational
Level: Informational
Task: AppXDeployment.Task.Server.OSIM

Description

Installing EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Message #

Installing EventLog manifest for package: '%1' (See 'Details' for extended information)

Fields #

Name	Description
`PackageFullName` UnicodeString
`UndockedDehDllParent` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment-Server-UndockedDeh",
    "guid": "43833E12-078D-4D7D-8AAF-AE8C8520F18C",
    "event_source_name": "",
    "event_id": 9000,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-12T20:24:32.772993+00:00",
    "event_record_id": 20,
    "correlation": {
      "ActivityID": "43A6D212-9A2A-0002-5477-AB432A9ADC01"
    },
    "execution": {
      "process_id": 14100,
      "thread_id": 14308
    },
    "channel": "Microsoft-Windows-AppXDeployment-Server/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageFullName": "Microsoft.WindowsAppRuntime.1.8_8000.770.947.0_x86__8wekyb3d8bbwe",
    "UndockedDehDllParent": "WindowsAppSdk.AppxDeploymentExtensions.Desktop.dll"
  },
  "message": ""
}

Event ID 9001: Uninstalling EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Provider: Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel: Operational
Level: Informational
Task: AppXDeployment.Task.Server.OSIM

Description

Uninstalling EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Message #

Uninstalling EventLog manifest for package: '%1' (See 'Details' for extended information)

Fields #

Name	Description
`PackageFullName` UnicodeString
`UndockedDehDllParent` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment-Server-UndockedDeh",
    "guid": "43833E12-078D-4D7D-8AAF-AE8C8520F18C",
    "event_source_name": "",
    "event_id": 9001,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-14T21:02:04.441681+00:00",
    "event_record_id": 29,
    "correlation": {
      "ActivityID": "43A6D212-9A2A-0002-BE97-B0432A9ADC01"
    },
    "execution": {
      "process_id": 10288,
      "thread_id": 8476
    },
    "channel": "Microsoft-Windows-AppXDeployment-Server/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageFullName": "Microsoft.WindowsAppRuntime.1.8_8000.731.1532.0_x86__8wekyb3d8bbwe",
    "UndockedDehDllParent": "WindowsAppSdk.AppxDeploymentExtensions.Desktop.dll"
  },
  "message": ""
}

Event ID 9002: Installed EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Provider: Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel: Operational
Level: Informational
Task: AppXDeployment.Task.Server.OSIM

Description

Installed EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Message #

Installed EventLog manifest for package: '%1' (See 'Details' for extended information)

Fields #

Name	Description
`PackageFullName` UnicodeString
`UndockedDehDllParent` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment-Server-UndockedDeh",
    "guid": "43833E12-078D-4D7D-8AAF-AE8C8520F18C",
    "event_source_name": "",
    "event_id": 9002,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-12T20:24:33.569657+00:00",
    "event_record_id": 22,
    "correlation": {
      "ActivityID": "43A6D212-9A2A-0002-5477-AB432A9ADC01"
    },
    "execution": {
      "process_id": 14100,
      "thread_id": 14308
    },
    "channel": "Microsoft-Windows-AppXDeployment-Server/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageFullName": "Microsoft.WindowsAppRuntime.1.8_8000.770.947.0_x86__8wekyb3d8bbwe",
    "UndockedDehDllParent": "WindowsAppSdk.AppxDeploymentExtensions.Desktop.dll"
  },
  "message": ""
}

Event ID 9003: Uninstalled EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Provider: Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel: Operational
Level: Informational
Task: AppXDeployment.Task.Server.OSIM

Description

Uninstalled EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Message #

Uninstalled EventLog manifest for package: '%1' (See 'Details' for extended information)

Fields #

Name	Description
`PackageFullName` UnicodeString
`UndockedDehDllParent` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment-Server-UndockedDeh",
    "guid": "43833E12-078D-4D7D-8AAF-AE8C8520F18C",
    "event_source_name": "",
    "event_id": 9003,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-14T21:02:04.442072+00:00",
    "event_record_id": 30,
    "correlation": {
      "ActivityID": "43A6D212-9A2A-0002-BE97-B0432A9ADC01"
    },
    "execution": {
      "process_id": 10288,
      "thread_id": 8476
    },
    "channel": "Microsoft-Windows-AppXDeployment-Server/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageFullName": "Microsoft.WindowsAppRuntime.1.8_8000.731.1532.0_x86__8wekyb3d8bbwe",
    "UndockedDehDllParent": "WindowsAppSdk.AppxDeploymentExtensions.Desktop.dll"
  },
  "message": ""
}

Event ID 9004: Setting active EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Provider: Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel: Operational
Task: AppXDeployment.Task.Server.OSIM

Description

Setting active EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Message #

Setting active EventLog manifest for package: '%1' (See 'Details' for extended information)

Fields #

Name	Description
`PackageFullName` UnicodeString
`UndockedDehDllParent` UnicodeString

Event ID 9005: Unsetting active EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Provider: Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel: Operational
Level: Informational
Task: AppXDeployment.Task.Server.OSIM

Description

Unsetting active EventLog manifest for package: 'PackageFullName' (See 'Details' for extended information).

Message #

Unsetting active EventLog manifest for package: '%1' (See 'Details' for extended information)

Fields #

Name	Description
`PackageFullName` UnicodeString
`UndockedDehDllParent` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment-Server-UndockedDeh",
    "guid": "43833E12-078D-4D7D-8AAF-AE8C8520F18C",
    "event_source_name": "",
    "event_id": 9005,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-12T20:24:32.774106+00:00",
    "event_record_id": 21,
    "correlation": {
      "ActivityID": "43A6D212-9A2A-0002-5477-AB432A9ADC01"
    },
    "execution": {
      "process_id": 14100,
      "thread_id": 14308
    },
    "channel": "Microsoft-Windows-AppXDeployment-Server/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageFullName": "Microsoft.WindowsAppRuntime.1.8_8000.770.947.0_x64__8wekyb3d8bbwe",
    "UndockedDehDllParent": "WindowsAppSdk.AppxDeploymentExtensions.Desktop.dll"
  },
  "message": ""
}

Event ID 10001: Loading registration table for Undocked DEH dll: DllName, Path: DllPath, Phase: DehPhase.

Provider: Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel: Operational
Task: AppXDeployment.Task.Server.OSIM

Description

Loading registration table for Undocked DEH dll: DllName, Path: DllPath, Phase: DehPhase.

Message #

Loading registration table for Undocked DEH dll: %1, Path: %2, Phase: %3

Fields #

Name	Description
`DllName` UnicodeString
`DllPath` UnicodeString
`DehPhase` HexInt32

Event ID 10002: Evaluating request for DEH: DEH 'DehName' in Phase 'DehPhase'.

Provider: Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel: Operational
Level: Verbose
Task: AppXDeployment.Task.Server.OSIM

Description

Evaluating request for DEH: DEH 'DehName' in Phase 'DehPhase'.

Message #

Evaluating request for DEH: DEH '%1' in Phase '%2'

Fields #

Name	Description
`DehName` UnicodeString
`DehPhase` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment-Server-UndockedDeh",
    "guid": "43833E12-078D-4D7D-8AAF-AE8C8520F18C",
    "event_source_name": "",
    "event_id": 10002,
    "version": 0,
    "level": 5,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-14T21:02:04.440924+00:00",
    "event_record_id": 28,
    "correlation": {
      "ActivityID": "43A6D212-9A2A-0002-BE97-B0432A9ADC01"
    },
    "execution": {
      "process_id": 10288,
      "thread_id": 8476
    },
    "channel": "Microsoft-Windows-AppXDeployment-Server/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DehName": "WindowsAppSdk.UndockedDeh.InstallMyself.InstallMyselfDeh",
    "DehPhase": "0x1"
  },
  "message": ""
}

Event ID 10003: StringAddEntryEvent: StringAddEntryEvent.

Provider: Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel: Operational
Task: AppXDeployment.Task.Server.OSIM

Description

StringAddEntryEvent: StringAddEntryEvent.

Message #

StringAddEntryEvent: %1

Fields #

Name	Description
`ExceptionWhatString` AnsiString

Event ID 10004: Failed performing DEH request: Action 'DehAction' in DEH 'DehName' in Phase 'DehPhase' in State 'DehState' (See 'Details' for extended information).

Provider: Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel: Operational
Task: AppXDeployment.Task.Server.OSIM

Description

Failed performing DEH request: Action 'DehAction' in DEH 'DehName' in Phase 'DehPhase' in State 'DehState' (See 'Details' for extended information).

Message #

Failed performing DEH request: Action '%1' in DEH '%2' in Phase '%3' in State '%4' (See 'Details' for extended information)

Fields #

Name	Description
`DehAction` UnicodeString
`DehName` UnicodeString
`DehPhase` HexInt32
`DehState` UInt32
`ExceptionWhatString` AnsiString

Event ID 10005: Failed performing operation on entry: Operation 'Operation' on Entry 'EntryName' (See 'Details' for extended information).

Provider: Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel: Operational
Task: AppXDeployment.Task.Server.OSIM

Description

Failed performing operation on entry: Operation 'Operation' on Entry 'EntryName' (See 'Details' for extended information).

Message #

Failed performing operation on entry: Operation '%1' on Entry '%2' (See 'Details' for extended information)

Fields #

Name	Description
`Operation` UnicodeString	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`EntryName` UnicodeString
`SerializedEntry` UnicodeString
`StepCounter` UInt32
`ExceptionWhatString` AnsiString

Event ID 10006: Encountered package pair in DEH package evaluation: DEH 'DehName' in Phase 'DehPhase' State 'DehState' on Incoming Package 'IncomingPackage' and Outgoing Package 'OutgoingPackage'.

Provider: Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel: Operational
Task: AppXDeployment.Task.Server.OSIM

Description

Encountered package pair in DEH package evaluation: DEH 'DehName' in Phase 'DehPhase' State 'DehState' on Incoming Package 'IncomingPackage' and Outgoing Package 'OutgoingPackage' (See 'Details' for extended information).

Message #

Encountered package pair in DEH package evaluation: DEH '%1' in Phase '%2' State '%3' on Incoming Package '%4' and Outgoing Package '%5' (See 'Details' for extended information)

Fields #

Name	Description
`DehName` UnicodeString
`DehPhase` HexInt32
`DehState` UInt32
`IncomingPackage` UnicodeString
`OutgoingPackage` UnicodeString

Event ID 10007: Encountered package in DEH package evaluation: Direction 'Direction', DEH 'DehName', Package 'PackageFullName', PostOsUpgrade 'PostOsUpgrade', Phase 'DehPhase', State 'DehState'.

Provider: Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel: Operational
Level: Verbose
Task: AppXDeployment.Task.Server.OSIM

Description

Encountered package in DEH package evaluation: Direction 'Direction', DEH 'DehName', Package 'PackageFullName', PostOsUpgrade 'PostOsUpgrade', Phase 'DehPhase', State 'DehState' (See 'Details' for extended information).

Message #

Encountered package in DEH package evaluation: Direction '%1', DEH '%2', Package '%3', PostOsUpgrade '%4', Phase '%5', State '%6' (See 'Details' for extended information)

Fields #

Name	Description
`Direction` UnicodeString	Known values `%%14592` Inbound `%%14593` Outbound `%%14594` Forward `%%14595` Bidirectional
`DehName` UnicodeString
`PackageFullName` UnicodeString
`PostOsUpgrade` Boolean
`DehPhase` HexInt32
`DehState` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppXDeployment-Server-UndockedDeh",
    "guid": "43833E12-078D-4D7D-8AAF-AE8C8520F18C",
    "event_source_name": "",
    "event_id": 10007,
    "version": 0,
    "level": 5,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-14T21:02:04.440815+00:00",
    "event_record_id": 27,
    "correlation": {
      "ActivityID": "43A6D212-9A2A-0002-BE97-B0432A9ADC01"
    },
    "execution": {
      "process_id": 10288,
      "thread_id": 8476
    },
    "channel": "Microsoft-Windows-AppXDeployment-Server/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Direction": "Outgoing",
    "DehName": "WindowsAppSdk.UndockedDeh.InstallMyself.InstallMyselfDeh",
    "PackageFullName": "Microsoft.WindowsAppRuntime.1.8_8000.731.1532.0_x86__8wekyb3d8bbwe",
    "PostOsUpgrade": false,
    "DehPhase": "0x1",
    "DehState": 4
  },
  "message": ""
}

Event ID 10008: Failure working on items: Item count 'ItemCounter', Current item name 'ItemName', Step counter 'StepCounter'.

Provider: Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel: Operational
Task: AppXDeployment.Task.Server.OSIM

Description

Failure working on items: Item count 'ItemCounter', Current item name 'ItemName', Step counter 'StepCounter'.

Message #

Failure working on items: Item count '%1', Current item name '%2', Step counter '%3'

Fields #

Name	Description
`ItemCounter` UInt32
`ItemName` UnicodeString
`StepCounter` UInt32

Event ID 10009: Failure working on item: Item 'ItemName', Step counter 'StepCounter'.

Provider: Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel: Operational
Task: AppXDeployment.Task.Server.OSIM

Description

Failure working on item: Item 'ItemName', Step counter 'StepCounter'.

Message #

Failure working on item: Item '%1', Step counter '%2'

Fields #

Name	Description
`ItemName` UnicodeString
`StepCounter` UInt32

Event ID 10010: Failure at frame: File 'File', Line 'Line' (See 'Details' for extended information).

Provider: Microsoft-Windows-AppXDeployment-Server-UndockedDeh
Channel: Operational
Task: AppXDeployment.Task.Server.OSIM

Description

Failure at frame: File 'File', Line 'Line' (See 'Details' for extended information).

Message #

Failure at frame: File '%1', Line '%2' (See 'Details' for extended information)

Fields #

Name	Description
`File` AnsiString
`Line` UInt32
`ExceptionWhatString` AnsiString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 43833e12-078d-4d7d-8aaf-ae8c8520f18c

Defined in Program, which carries the event manifest.

Observed on:

Win11-26200.6584, schema read from the registered manifest, binary version 1.8, captured 2026-06-02

Downloads

Microsoft-Windows-AppXDeployment-Server-UndockedDeh registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)