Microsoft-Windows-BrokerInfrastructure

33 events across 3 channels

Event	Title	Channel	Sample
1	An instance of a background task with entry point TaskEntryPoint and name …	Diagnostic	N
2	An instance of the background task with entry point EntryPoint running for user …	Diagnostic	N
3	The background infrastructure service issued a proxy activation for the …	Diagnostic	N
4	Background task for package PackageFullName with entry point EntryPoint was …	Diagnostic	N
5	Background task for package PackageFullName with entry point EntryPoint was …	Diagnostic	N
6	Background task for package PackageFullName with entry point EntryPoint did not …	Operational	Y
7	A signal request for the trigger with ID EventId and type EventType has begun.	Diagnostic	N
8	The signal request for the trigger with ID EventId and type EventType has …	Diagnostic	N
9	The condition with ID EventId and type EventType is changing state from OldState …	Diagnostic	N
10	The condition with ID EventId and type EventType has changed state from OldState …	Diagnostic	N
11	The application package PackageFullName running for user UserAccountName in …	Diagnostic	N
12	The application package PackageFullName running for user UserAccountName in …	Diagnostic	N
13	A background task with entry point TaskEntryPoint and name TaskName has been …	Diagnostic	N
14	A background task with entry point TaskEntryPoint and name TaskName has been …	Diagnostic	N
15	A background task with entry point TaskEntryPoint and name TaskName has been …	Diagnostic	N
16	An activation of a background task with entry point TaskEntryPoint and name …	Diagnostic	N
17	An activation of a background task with entry point TaskEntryPoint and name …	Diagnostic	N
18	An activation of a background task with entry point TaskEntryPoint and name …	Diagnostic	N
19	An instance with ID InstanceId of a background task with entry point …	Diagnostic	N
20	A background task with entry point TaskEntryPoint and name TaskName has been …	Diagnostic	N
21	The background task with entry point TaskEntryPoint and name TaskName failed to …	Operational	Y
22	BackgroundTaskInstanceDCStop_V1	Operational	N
23	BackgroundTaskDCStop_V1	Operational	N
24	PackageDCStop_V1	Operational	N
25	The application package PackageFullName was terminated due to inactivity.	Diagnostic	N
26	WatchdogIteration_V1	Operational	N
27	A background task with entry point TaskEntryPoint and name TaskName in package …	Diagnostic	N
28	SessionStateTransition	Diagnostic	N
100	BackgroundTaskPerfTrackStop	Operational	N
101	WatchdogIterationPerfTrackWatchdogIteration	Operational	N
200	PdcReferenceAcquire	Operational	N
201	PdcReferenceRelease	Operational	N
300	WorkItemBlockingDisconnectedStandby	Operational	N

Event ID 1: An instance of a background task with entry point TaskEntryPoint and name TaskName has been created in session UserContextId and given an ID of InstanceId.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: BackgroundTask
Opcode: Start

Description

An instance of a background task with entry point TaskEntryPoint and name TaskName has been created in session UserContextId and given an ID of InstanceId.

Message #

An instance of a background task with entry point %2 and name %4 has been created in session %5 and given an ID of %6.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`UserContextId` UInt64
`InstanceId` GUID
`ApplicationId` UInt64
`PsmActivationType` UInt32
`CriticalActivation` Boolean
`TriggerEventId` GUID
`TriggerEventType` UInt32

Event ID 2: An instance of the background task with entry point EntryPoint running for user UserSid in session UserContextId returned with error code Result.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: BackgroundTask
Opcode: Stop

Description

An instance of the background task with entry point EntryPoint running for user UserSid in session UserContextId returned with error code Result.

Message #

An instance of the background task with entry point %9 running for user %6 in session %3 returned with error code %5.

Fields #

Name	Description
`WorkItemId` GUID
`BrokerId` GUID
`UserContextId` UInt64
`TaskExecuted` Boolean
`Result` UInt32
`UserSid` SID
`PackageFullName` UnicodeString
`EntryPointLength` UInt16
`EntryPoint` UnicodeString
`ApplicationId` UInt64
`CpuThrottleCount` UInt16
`NetThrottleCount` UInt16
`Flags` UInt16

Event ID 3: The background infrastructure service issued a proxy activation for the background task with ID WorkItemId.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: BackgroundTaskProxy

Description

The background infrastructure service issued a proxy activation for the background task with ID WorkItemId.

Message #

The background infrastructure service issued a proxy activation for the background task with ID %1.

Fields #

Name	Description
`WorkItemId` GUID
`BrokerId` GUID
`StateName` UInt64

Event ID 4: Background task for package PackageFullName with entry point EntryPoint was suspended due to CPU resource management policy.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskThrottledCpu

Description

Background task for package PackageFullName with entry point EntryPoint was suspended due to CPU resource management policy.

Message #

Background task for package %1 with entry point %3 was suspended due to CPU resource management policy.

Fields #

Name	Description
`PackageFullName` UnicodeString
`EntryPointLength` UInt16
`EntryPoint` UnicodeString
`UserSid` SID

Event ID 5: Background task for package PackageFullName with entry point EntryPoint was suspended due to Network resource management policy.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskThrottledNet

Description

Background task for package PackageFullName with entry point EntryPoint was suspended due to Network resource management policy.

Message #

Background task for package %1 with entry point %3 was suspended due to Network resource management policy.

Fields #

Name	Description
`PackageFullName` UnicodeString
`EntryPointLength` UInt16
`EntryPoint` UnicodeString
`UserSid` SID

Event ID 6: Background task for package PackageFullName with entry point EntryPoint did not complete in response to a cancel notification.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Operational
Level: Informational
Task: BackgroundTask
Opcode: TaskForcedCompletion

Description

Background task for package PackageFullName with entry point EntryPoint did not complete in response to a cancel notification.

Message #

Background task for package %1 with entry point %3 did not complete in response to a cancel notification.

Fields #

Name	Description
`PackageFullName` UnicodeString
`EntryPointLength` UInt16
`EntryPoint` UnicodeString
`UserSid` SID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-BrokerInfrastructure",
    "guid": "E6835967-E0D2-41FB-BCEC-58387404E25A",
    "event_source_name": "",
    "event_id": 6,
    "version": 0,
    "level": 4,
    "task": 100,
    "opcode": 102,
    "keywords": 4611686018427387905,
    "time_created": "2026-03-11T19:27:55.206435+00:00",
    "event_record_id": 445,
    "correlation": {},
    "execution": {
      "process_id": 1116,
      "thread_id": 5084
    },
    "channel": "Microsoft-Windows-BackgroundTaskInfrastructure/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageFullName": "MicrosoftWindows.Client.CBS_1000.22634.1000.0_x64__cw5n1h2txyewy",
    "EntryPointLength": 38,
    "EntryPoint": "IrisService.BackgroundTask.UpdateTimer",
    "UserSid": "S-1-5-21-3407486967-1585450050-1838039599-1000"
  },
  "message": ""
}

Event ID 7: A signal request for the trigger with ID EventId and type EventType has begun.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: TriggerSignal
Opcode: Start

Description

A signal request for the trigger with ID EventId and type EventType has begun.

Message #

A signal request for the trigger with ID %1 and type %2 has begun.

Fields #

Name	Description
`EventId` GUID
`EventType` UInt32

Event ID 8: The signal request for the trigger with ID EventId and type EventType has completed.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: TriggerSignal
Opcode: Stop

Description

The signal request for the trigger with ID EventId and type EventType has completed.

Message #

The signal request for the trigger with ID %1 and type %2 has completed.

Fields #

Name	Description
`EventId` GUID
`EventType` UInt32

Event ID 9: The condition with ID EventId and type EventType is changing state from OldState to NewState.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: ConditionChange
Opcode: Start

Description

The condition with ID EventId and type EventType is changing state from OldState to NewState.

Message #

The condition with ID %1 and type %2 is changing state from %3 to %4.

Fields #

Name	Description
`EventId` GUID
`EventType` UInt32
`OldState` UInt32
`NewState` Boolean

Event ID 10: The condition with ID EventId and type EventType has changed state from OldState to NewState.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: ConditionChange
Opcode: Stop

Description

The condition with ID EventId and type EventType has changed state from OldState to NewState.

Message #

The condition with ID %1 and type %2 has changed state from %3 to %4.

Fields #

Name	Description
`EventId` GUID
`EventType` UInt32
`OldState` UInt32
`NewState` Boolean

Event ID 11: The application package PackageFullName running for user UserAccountName in session UserContextId is changing state to PackageState.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: PackageStateChange
Opcode: Start

Description

The application package PackageFullName running for user UserAccountName in session UserContextId is changing state to PackageState.

Message #

The application package %1 running for user %2 in session %3 is changing state to %4.

Fields #

Name	Description
`PackageFullName` UnicodeString
`UserAccountName` UnicodeString
`UserContextId` UInt64
`PackageState` UInt32

Event ID 12: The application package PackageFullName running for user UserAccountName in session UserContextId has changed to state PackageState.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: PackageStateChange
Opcode: Stop

Description

The application package PackageFullName running for user UserAccountName in session UserContextId has changed to state PackageState.

Message #

The application package %1 running for user %2 in session %3 has changed to state %4.

Fields #

Name	Description
`PackageFullName` UnicodeString
`UserAccountName` UnicodeString
`UserContextId` UInt64
`PackageState` UInt32

Event ID 13: A background task with entry point TaskEntryPoint and name TaskName has been latched because its condition of type ConditionType has value ConditionValue but value ConditionDesiredValue was desired.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskLatched

Description

A background task with entry point TaskEntryPoint and name TaskName has been latched because its condition of type ConditionType has value ConditionValue but value ConditionDesiredValue was desired.

Message #

A background task with entry point %2 and name %4 has been latched because its condition of type %5 has value %6 but value %7 was desired.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`ConditionType` UInt32
`ConditionValue` UInt32
`ConditionDesiredValue` Boolean

Event ID 14: A background task with entry point TaskEntryPoint and name TaskName has been unlatched.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskUnlatched

Description

A background task with entry point TaskEntryPoint and name TaskName has been unlatched.

Message #

A background task with entry point %2 and name %4 has been unlatched.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString

Event ID 15: A background task with entry point TaskEntryPoint and name TaskName has been dropped.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskDropped

Description

A background task with entry point TaskEntryPoint and name TaskName has been dropped.

Message #

A background task with entry point %2 and name %4 has been dropped.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString

Event ID 16: An activation of a background task with entry point TaskEntryPoint and name TaskName has been buffered because an instance of the task is already running.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskBufferedPolicy

Description

An activation of a background task with entry point TaskEntryPoint and name TaskName has been buffered because an instance of the task is already running.

Message #

An activation of a background task with entry point %2 and name %4 has been buffered because an instance of the task is already running.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString

Event ID 17: An activation of a background task with entry point TaskEntryPoint and name TaskName has been buffered because BufferingReason.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskBufferedPackageState

Description

An activation of a background task with entry point TaskEntryPoint and name TaskName has been buffered because BufferingReason.

Message #

An activation of a background task with entry point %2 and name %4 has been buffered because %5.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`BufferingReason` UInt32

Event ID 18: An activation of a background task with entry point TaskEntryPoint and name TaskName that was buffered because BufferingReason has been unbuffered.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskUnbuffered

Description

An activation of a background task with entry point TaskEntryPoint and name TaskName that was buffered because BufferingReason has been unbuffered.

Message #

An activation of a background task with entry point %2 and name %4 that was buffered because %5 has been unbuffered.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`BufferingReason` UInt32

Event ID 19: An instance with ID InstanceId of a background task with entry point TaskEntryPoint and name TaskName has been canceled in session UserContextId.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskCanceled

Description

An instance with ID InstanceId of a background task with entry point TaskEntryPoint and name TaskName has been canceled in session UserContextId.

Message #

An instance with ID %5 of a background task with entry point %2 and name %4 has been canceled in session %6.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`InstanceId` GUID
`UserContextId` UInt64

Event ID 20: A background task with entry point TaskEntryPoint and name TaskName has been unregistered because DeletionReason.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskUnregistered

Description

A background task with entry point TaskEntryPoint and name TaskName has been unregistered because DeletionReason.

Message #

A background task with entry point %2 and name %4 has been unregistered because %5.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`DeletionReason` UInt32

Event ID 21: The background task with entry point TaskEntryPoint and name TaskName failed to activate with error code Result.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Operational
Level: Informational
Task: BackgroundTask
Opcode: TaskActivationFailed

Description

The background task with entry point TaskEntryPoint and name TaskName failed to activate with error code Result.

Message #

The background task with entry point %2 and name %4 failed to activate with error code %5.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`Result` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-BrokerInfrastructure",
    "guid": "E6835967-E0D2-41FB-BCEC-58387404E25A",
    "event_source_name": "",
    "event_id": 21,
    "version": 0,
    "level": 4,
    "task": 100,
    "opcode": 113,
    "keywords": 4611686018427387905,
    "time_created": "2026-03-12T02:57:25.195310+00:00",
    "event_record_id": 465,
    "correlation": {},
    "execution": {
      "process_id": 1116,
      "thread_id": 5364
    },
    "channel": "Microsoft-Windows-BackgroundTaskInfrastructure/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "EntryPointLength": 38,
    "TaskEntryPoint": "{8cfc164f-4be5-4fdd-94e9-e2af73ed4a19}",
    "NameLength": 28,
    "TaskName": "DashboardBackgroundFeedsTask",
    "Result": 2147746132
  },
  "message": ""
}

Event ID 22: BackgroundTaskInstanceDCStop_V1

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Operational
Task: BackgroundTaskInstance
Opcode: DC_Stop

Fields #

Name	Description
`WorkItemId` GUID
`ApplicationId` UInt64
`UserContextId` UInt64
`PsmActivationType` UInt32
`CpuThrottleCount` UInt16
`NetThrottleCount` UInt16
`PackageFullName` UnicodeString

Event ID 23: BackgroundTaskDCStop_V1

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Operational
Task: BackgroundTask
Opcode: DC_Stop

Fields #

Name	Description
`WorkItemId` GUID
`BrokerId` GUID
`TriggerEventId` GUID
`TriggerEventType` UInt32
`CriticalActivation` Boolean
`EntryPointLength` UInt16
`EntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`PackageFullName` UnicodeString
`UserSid` SID
`ConditionCount` UInt16
`ConditinalEvent` Boolean

Event ID 24: PackageDCStop_V1

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Operational
Task: Package
Opcode: DC_Stop

Fields #

Name	Description
`UserContextId` UInt64
`StateFlags` UInt32
`ActiveTaskCount` UInt32
`LockScreen` Boolean
`PackageFullName` UnicodeString
`UserSid` SID

Event ID 25: The application package PackageFullName was terminated due to inactivity.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: Package
Opcode: PackageWatchdog

Description

The application package PackageFullName was terminated due to inactivity. The following ActiveTaskCount background task(s) were running ActiveTasks.

Message #

The application package %5 was terminated due to inactivity. The following %3 background task(s) were running %7.

Fields #

Name	Description
`SessionId` UInt32
`StateFlags` UInt32
`ActiveTaskCount` UInt32
`LockScreen` Boolean
`PackageFullName` UnicodeString
`UserSid` SID
`ActiveTasks` UnicodeString

Event ID 26: WatchdogIteration_V1

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Operational
Task: WatchdogIteration
Opcode: WatchdogIteration

Fields #

Name	Description
`Duration` UInt32
`Iteration` UInt32
`ActivitySummary` UInt32
`ActivityFilter` UInt32
`HangDetected` Boolean
`EventType` UInt32
`PackageFullName` UnicodeString
`EntryPoint` UnicodeString
`InstanceId` GUID
`CycleTime` UInt64
`NetTokens` UInt64
`PolicyVersion` UInt8

Event ID 27: A background task with entry point TaskEntryPoint and name TaskName in package PackageFullName is being canceled because it has an inactive instance running in session UserContextId.

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskWatchdog

Description

A background task with entry point TaskEntryPoint and name TaskName in package PackageFullName is being canceled because it has an inactive instance running in session UserContextId.

Message #

A background task with entry point %2 and name %4 in package %5 is being canceled because it has an inactive instance running in session %7.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`PackageFullName` UnicodeString
`InstanceId` GUID
`UserContextId` UInt64
`UserSid` SID
`LockScreen` Boolean

Event ID 28: SessionStateTransition

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Diagnostic
Task: SessionStateTransition
Opcode: SessionStateTransition

Fields #

Name	Description
`SessionId` UInt32
`TransitionId` UInt32
`Transition` UInt32

Event ID 100: BackgroundTaskPerfTrackStop

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Operational
Task: BackgroundTaskPerfTrack
Opcode: Stop

Fields #

Name	Description
`ElapsedTime` UInt32
`TaskThrottleCount` UInt32
`EventType` UInt32
`PackageFullName` UnicodeString
`EntryPoint` UnicodeString

Event ID 101: WatchdogIterationPerfTrackWatchdogIteration

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Operational
Task: WatchdogIterationPerfTrack
Opcode: WatchdogIteration

Fields #

Name	Description
`Duration` UInt32
`ActivitySummary` UInt32
`EventTypeAndBitfield` UInt32
`PackageFullName` UnicodeString
`EntryPoint` UnicodeString

Event ID 200: PdcReferenceAcquire

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Operational
Task: PdcReference
Opcode: Acquire

Fields #

Name	Description
`ActivityType` UInt32
`PackageFullName` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString

Event ID 201: PdcReferenceRelease

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Operational
Task: PdcReference
Opcode: Release

Fields #

Name	Description
`ActivityType` UInt32
`PackageFullName` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString

Event ID 300: WorkItemBlockingDisconnectedStandby

Provider: Microsoft-Windows-BrokerInfrastructure
Channel: Operational
Task: WorkItemBlockingDisconnectedStandby
Opcode: WorkItemBlockingDisconnectedStandby

Fields #

Name	Description
`WorkItemId` GUID
`EntryPointLength` UInt16
`EntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`PackageFullName` UnicodeString
`UserSid` SID
`TriggerEventType` UInt32
`ScenarioInstanceId` UInt16
`AlwaysAllowed` Boolean
`VoipApp` Boolean

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID e6835967-e0d2-41fb-bcec-58387404e25a

Defined in bisrv.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)