Microsoft-Windows-CEIP

7 events across 1 channel

Event	Title	Channel	Sample
1073742829	Customer Experience Improvement Program data was successfully consolidated into …	Operational	N
1073742831	Customer Experience Improvement Program data was successfully sent to Microsoft.	Operational	N
1073742833	The Customer Experience Improvement Program Opt-in notification was displayed to …	Operational	N
3221226478	A problem prevented Customer Experience Improvement Program data from being …	Operational	N
3221226480	A problem prevented Customer Experience Improvement Program data from being sent …	Operational	N
3221226482	A problem prevented the Customer Experience Improvement Program Opt-in …	Operational	N
3221226483	The Customer Experience Improvement Program downloaded new manifest; {param1} …	Operational	N

Event ID 1073742829: Customer Experience Improvement Program data was successfully consolidated into files that will be sent to Microsoft for analysis.

Provider: Microsoft-Windows-CEIP
Channel: Operational

Message #

Customer Experience Improvement Program data was successfully consolidated into files that will be sent to Microsoft for analysis. These files will be sent only if the user has opted to join the Windows Customer Experience Improvement Program.

Event ID 1073742831: Customer Experience Improvement Program data was successfully sent to Microsoft.

Provider: Microsoft-Windows-CEIP
Channel: Operational

Description

Customer Experience Improvement Program data was successfully sent to Microsoft.

Message #

Customer Experience Improvement Program data was successfully sent to Microsoft.

Event ID 1073742833: The Customer Experience Improvement Program Opt-in notification was displayed to the user.

Provider: Microsoft-Windows-CEIP
Channel: Operational

Description

The Customer Experience Improvement Program Opt-in notification was displayed to the user.

Message #

The Customer Experience Improvement Program Opt-in notification was displayed to the user.

Event ID 3221226478: A problem prevented Customer Experience Improvement Program data from being consolidated into files that can be sent to Microsoft; (Error {param1}).

Provider: Microsoft-Windows-CEIP
Channel: Operational

Description

A problem prevented Customer Experience Improvement Program data from being consolidated into files that can be sent to Microsoft; (Error {param1}).

Message #

A problem prevented Customer Experience Improvement Program data from being consolidated into files that can be sent to Microsoft; (Error {param1}).

Fields #

Name	Description
`param1`

Event ID 3221226480: A problem prevented Customer Experience Improvement Program data from being sent to Microsoft; (Error {param1}).

Provider: Microsoft-Windows-CEIP
Channel: Operational

Description

A problem prevented Customer Experience Improvement Program data from being sent to Microsoft; (Error {param1}).

Message #

A problem prevented Customer Experience Improvement Program data from being sent to Microsoft; (Error {param1}).

Fields #

Name	Description
`param1`

Event ID 3221226482: A problem prevented the Customer Experience Improvement Program Opt-in notification from being displayed.

Provider: Microsoft-Windows-CEIP
Channel: Operational

Description

A problem prevented the Customer Experience Improvement Program Opt-in notification from being displayed. (Error {param1}).

Message #

A problem prevented the Customer Experience Improvement Program Opt-in notification from being displayed. (Error {param1})

Fields #

Name	Description
`param1`

Event ID 3221226483: The Customer Experience Improvement Program downloaded new manifest; {param1} from Server.

Provider: Microsoft-Windows-CEIP
Channel: Operational

Description

The Customer Experience Improvement Program downloaded new manifest; {param1} from Server.

Message #

The Customer Experience Improvement Program downloaded new manifest; {param1} from Server.

Fields #

Name	Description
`param1`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-CEIP

Event ID 1073742829: Customer Experience Improvement Program data was successfully consolidated into files that will be sent to Microsoft for analysis.

Message #

Event ID 1073742831: Customer Experience Improvement Program data was successfully sent to Microsoft.

Description

Message #

Event ID 1073742833: The Customer Experience Improvement Program Opt-in notification was displayed to the user.

Description

Message #

Event ID 3221226478: A problem prevented Customer Experience Improvement Program data from being consolidated into files that can be sent to Microsoft; (Error {param1}).

Description

Message #

Fields #

Event ID 3221226480: A problem prevented Customer Experience Improvement Program data from being sent to Microsoft; (Error {param1}).

Description

Message #

Fields #

Event ID 3221226482: A problem prevented the Customer Experience Improvement Program Opt-in notification from being displayed.

Description

Message #

Fields #

Event ID 3221226483: The Customer Experience Improvement Program downloaded new manifest; {param1} from Server.

Description

Message #

Fields #

Keyboard shortcuts

Search operators