Microsoft-Windows-Connected-Search

49 events across 3 channels

Event	Title	Channel	Sample
1	Starting query with query term {QueryTerm}{QueryTerm} for type {Type}{Type}.	Debug	N
2	Completed query with query term {QueryTerm}{QueryTerm} for type {Type}{Type}.	Debug	N
3	Impression Id {ImpressionId}{ImpressionId} : Ref Id {RefId}{RefId} : Query …	Operational	N
4	Using Cached RSS instead of querying service.	Analytic	N
100	Fetching url {Url}{Url} with headers {Headers}{Headers} and user-agent string …	Debug	N
101	Finished fetching url {Url}{Url} with result {Result}{Result}.	Debug	N
102	Opening HTTP connection to host {HostName}{HostName} on port {Port}{Port}.	Debug	N
103	HTTP request failed with status code {StatusCode}{StatusCode}.	Debug	N
104	X-Search-GetAuthStatus Http header added: {HTTPHeaderValue}{HTTPHeaderValue}.	Analytic	N
105	X-Search-AuthStatus Http header returned: {HTTPHeaderValue}{HTTPHeaderValue}.	Analytic	N
106	X-Search-AuthStatus Http header not found	Analytic	N
107	Error returned when reading HTTP Request response {AsyncError}{AsyncError}.	Debug	N
108	Read {Bytes}{Bytes} bytes from HTTP response with error {Result}{Result}.	Analytic	N
109	Wrote {Bytes}{Bytes} bytes from HTTP response with error {Result}{Result}.	Analytic	N
110	HTTP Status {InternetStatus}{InternetStatus}.	Analytic	N
111	X-Search-Location Http header added: {HTTPHeaderName}{HTTPHeaderName}: …	Analytic	N
112	Wrote {Bytes}{Bytes} pending bytes from HTTP response with error …	Analytic	N
113	Failed to open request to URL: {Url}{Url} with error {Result}{Result}.	Debug	N
114	Failed to send request to URL: {Url}{Url} with error {Result}{Result}.	Debug	N
115	X-PreferDomain Http header returned: {HTTPHeaderValue}{HTTPHeaderValue}.	Analytic	N
116	X-PreferDomain Http header not found	Analytic	N
117	X-Charm-Privacy Http header added: {HTTPHeaderValue}{HTTPHeaderValue}.	Analytic	N
118	X-SQM Http header added: {HTTPHeaderName}{HTTPHeaderName}: …	Analytic	N
119	Referer Http header added: {HTTPHeaderName}{HTTPHeaderName}: …	Analytic	N
200	Starting to parse XML response of type: {Type}{Type}.	Debug	N
201	Finished parsing XML response of type: {Type}{Type} with result …	Debug	N
202	Result set Impression Id {ImpressionId}{ImpressionId}.	Debug	N
203	Impression Id: {ImpressionId}{ImpressionId}.	Analytic	N
204	Impression Id: {ImpressionId}{ImpressionId}.	Analytic	N
205	Impression Id: {ImpressionId}{ImpressionId}.	Analytic	N
206	Impression Id: {ImpressionId}{ImpressionId}.	Analytic	N
207	Impression Id: {ImpressionId}{ImpressionId}.	Analytic	N
208	Impression Id: {ImpressionId}{ImpressionId}.	Analytic	N
209	Impression Id: {ImpressionId}{ImpressionId}.	Analytic	N
210	Impression Id: {ImpressionId}{ImpressionId}.	Analytic	N
211	Impression Id: {ImpressionId}{ImpressionId}.	Analytic	N
212	Impression Id: {ImpressionId}{ImpressionId}.	Analytic	N
213	Impression Id: {ImpressionId}{ImpressionId}.	Analytic	N
214	Impression Id: {ImpressionId}{ImpressionId}.	Debug	N
215	Failed parsing XML response of type: {Type}{Type} with result {Result}{Result}.	Debug	N
216	Impression Id: {ImpressionId}{ImpressionId}.	Analytic	N
217	Impression Id: {ImpressionId}{ImpressionId}.	Analytic	N
300	Query Suggestions throttling minimum query length set to length …	Analytic	N
301	Query Suggestions throttling timeout value set to value {Timeout}{Timeout}.	Analytic	N
302	Query Suggestions throttling being applied for timeout {Timeout}{Timeout}.	Analytic	N
303	Suggestions query term {QueryTerm}{QueryTerm} does not meet minimum query length …	Analytic	N
400	Executing connected search query of type {Type}{Type}.	Analytic	N
401	Completed connected search query of type {Type}{Type} with result …	Analytic	N
402	Connected search query of type {Type}{Type} failed with result {Result}{Result}.	Debug	N

Event ID 1: Starting query with query term {QueryTerm}{QueryTerm} for type {Type}{Type}.

Provider: Microsoft-Windows-Connected-Search
Channel: Debug

Description

Starting query with query term {QueryTerm}{QueryTerm} for type {Type}{Type}.

Message #

Starting query with query term {QueryTerm}{QueryTerm} for type {Type}{Type}.

Fields #

Name	Description
`QueryTerm`
`Type`

Event ID 2: Completed query with query term {QueryTerm}{QueryTerm} for type {Type}{Type}.

Provider: Microsoft-Windows-Connected-Search
Channel: Debug

Description

Completed query with query term {QueryTerm}{QueryTerm} for type {Type}{Type}. Result {Result}{Result}.

Message #

Completed query with query term {QueryTerm}{QueryTerm} for type {Type}{Type}.  Result {Result}{Result}

Fields #

Name	Description
`QueryTerm`
`Type`
`Result`

Event ID 3: Impression Id {ImpressionId}{ImpressionId} : Ref Id {RefId}{RefId} : Query {Query}{Query}.

Provider: Microsoft-Windows-Connected-Search
Channel: Operational

Description

Impression Id {ImpressionId}{ImpressionId} : Ref Id {RefId}{RefId} : Query {Query}{Query}.

Message #

Impression Id {ImpressionId}{ImpressionId} : Ref Id {RefId}{RefId} : Query {Query}{Query}

Fields #

Name	Description
`ImpressionId`
`RefId`
`Query`

Event ID 4: Using Cached RSS instead of querying service.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Using Cached RSS instead of querying service.

Message #

Using Cached RSS instead of querying service.

Event ID 100: Fetching url {Url}{Url} with headers {Headers}{Headers} and user-agent string {User-Agent}{User-Agent}.

Provider: Microsoft-Windows-Connected-Search
Channel: Debug

Description

Fetching url {Url}{Url} with headers {Headers}{Headers} and user-agent string {User-Agent}{User-Agent}.

Message #

Fetching url {Url}{Url} with headers {Headers}{Headers} and user-agent string {User-Agent}{User-Agent}

Fields #

Name	Description
`Url`
`Headers`

Event ID 101: Finished fetching url {Url}{Url} with result {Result}{Result}.

Provider: Microsoft-Windows-Connected-Search
Channel: Debug

Description

Finished fetching url {Url}{Url} with result {Result}{Result}.

Message #

Finished fetching url {Url}{Url} with result {Result}{Result}

Fields #

Name	Description
`Url`
`Result`

Event ID 102: Opening HTTP connection to host {HostName}{HostName} on port {Port}{Port}.

Provider: Microsoft-Windows-Connected-Search
Channel: Debug

Description

Opening HTTP connection to host {HostName}{HostName} on port {Port}{Port}.

Message #

Opening HTTP connection to host {HostName}{HostName} on port {Port}{Port}

Fields #

Name	Description
`HostName`
`Port`

Event ID 103: HTTP request failed with status code {StatusCode}{StatusCode}.

Provider: Microsoft-Windows-Connected-Search
Channel: Debug

Description

HTTP request failed with status code {StatusCode}{StatusCode}.

Message #

HTTP request failed with status code {StatusCode}{StatusCode}

Fields #

Name	Description
`StatusCode`	NTSTATUS reference

Event ID 104: X-Search-GetAuthStatus Http header added: {HTTPHeaderValue}{HTTPHeaderValue}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

X-Search-GetAuthStatus Http header added: {HTTPHeaderValue}{HTTPHeaderValue}.

Message #

X-Search-GetAuthStatus Http header added: {HTTPHeaderValue}{HTTPHeaderValue}

Fields #

Name	Description
`HTTPHeaderValue`

Event ID 105: X-Search-AuthStatus Http header returned: {HTTPHeaderValue}{HTTPHeaderValue}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

X-Search-AuthStatus Http header returned: {HTTPHeaderValue}{HTTPHeaderValue}.

Message #

X-Search-AuthStatus Http header returned: {HTTPHeaderValue}{HTTPHeaderValue}

Fields #

Name	Description
`HTTPHeaderValue`

Event ID 106: X-Search-AuthStatus Http header not found

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

X-Search-AuthStatus Http header not found.

Message #

X-Search-AuthStatus Http header not found

Event ID 107: Error returned when reading HTTP Request response {AsyncError}{AsyncError}.

Provider: Microsoft-Windows-Connected-Search
Channel: Debug

Description

Error returned when reading HTTP Request response {AsyncError}{AsyncError}.

Message #

Error returned when reading HTTP Request response {AsyncError}{AsyncError}

Fields #

Name	Description
`AsyncError`

Event ID 108: Read {Bytes}{Bytes} bytes from HTTP response with error {Result}{Result}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Read {Bytes}{Bytes} bytes from HTTP response with error {Result}{Result}.

Message #

Read {Bytes}{Bytes} bytes from HTTP response with error {Result}{Result}

Fields #

Name	Description
`Bytes`
`Result`

Event ID 109: Wrote {Bytes}{Bytes} bytes from HTTP response with error {Result}{Result}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Wrote {Bytes}{Bytes} bytes from HTTP response with error {Result}{Result}.

Message #

Wrote {Bytes}{Bytes} bytes from HTTP response with error {Result}{Result}

Fields #

Name	Description
`Bytes`
`Result`

Event ID 110: HTTP Status {InternetStatus}{InternetStatus}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

HTTP Status {InternetStatus}{InternetStatus}.

Message #

HTTP Status {InternetStatus}{InternetStatus}.

Fields #

Name	Description
`InternetStatus`

Event ID 111: X-Search-Location Http header added: {HTTPHeaderName}{HTTPHeaderName}: {HTTPheaderValue}{HTTPheaderValue}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

X-Search-Location Http header added: {HTTPHeaderName}{HTTPHeaderName}: {HTTPheaderValue}{HTTPheaderValue}.

Message #

X-Search-Location Http header added: {HTTPHeaderName}{HTTPHeaderName}: {HTTPheaderValue}{HTTPheaderValue}

Fields #

Name	Description
`HTTPHeaderName`
`HTTPheaderValue`

Event ID 112: Wrote {Bytes}{Bytes} pending bytes from HTTP response with error {Result}{Result}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Wrote {Bytes}{Bytes} pending bytes from HTTP response with error {Result}{Result}.

Message #

Wrote {Bytes}{Bytes} pending bytes from HTTP response with error {Result}{Result}

Fields #

Name	Description
`Bytes`
`Result`

Event ID 113: Failed to open request to URL: {Url}{Url} with error {Result}{Result}.

Provider: Microsoft-Windows-Connected-Search
Channel: Debug

Description

Failed to open request to URL: {Url}{Url} with error {Result}{Result}.

Message #

Failed to open request to URL: {Url}{Url} with error {Result}{Result}

Fields #

Name	Description
`Url`
`Result`

Event ID 114: Failed to send request to URL: {Url}{Url} with error {Result}{Result}.

Provider: Microsoft-Windows-Connected-Search
Channel: Debug

Description

Failed to send request to URL: {Url}{Url} with error {Result}{Result}.

Message #

Failed to send request to URL: {Url}{Url} with error {Result}{Result}

Fields #

Name	Description
`Url`
`Result`

Event ID 115: X-PreferDomain Http header returned: {HTTPHeaderValue}{HTTPHeaderValue}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

X-PreferDomain Http header returned: {HTTPHeaderValue}{HTTPHeaderValue}.

Message #

X-PreferDomain Http header returned: {HTTPHeaderValue}{HTTPHeaderValue}

Fields #

Name	Description
`HTTPHeaderValue`

Event ID 116: X-PreferDomain Http header not found

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

X-PreferDomain Http header not found.

Message #

X-PreferDomain Http header not found

Event ID 117: X-Charm-Privacy Http header added: {HTTPHeaderValue}{HTTPHeaderValue}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

X-Charm-Privacy Http header added: {HTTPHeaderValue}{HTTPHeaderValue}.

Message #

X-Charm-Privacy Http header added: {HTTPHeaderValue}{HTTPHeaderValue}

Fields #

Name	Description
`HTTPHeaderValue`

Event ID 118: X-SQM Http header added: {HTTPHeaderName}{HTTPHeaderName}: {HTTPheaderValue}{HTTPheaderValue}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

X-SQM Http header added: {HTTPHeaderName}{HTTPHeaderName}: {HTTPheaderValue}{HTTPheaderValue}.

Message #

X-SQM Http header added: {HTTPHeaderName}{HTTPHeaderName}: {HTTPheaderValue}{HTTPheaderValue}

Fields #

Name	Description
`HTTPHeaderName`
`HTTPheaderValue`

Event ID 119: Referer Http header added: {HTTPHeaderName}{HTTPHeaderName}: {HTTPheaderValue}{HTTPheaderValue}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Referer Http header added: {HTTPHeaderName}{HTTPHeaderName}: {HTTPheaderValue}{HTTPheaderValue}.

Message #

Referer Http header added: {HTTPHeaderName}{HTTPHeaderName}: {HTTPheaderValue}{HTTPheaderValue}

Fields #

Name	Description
`HTTPHeaderName`
`HTTPheaderValue`

Event ID 200: Starting to parse XML response of type: {Type}{Type}.

Provider: Microsoft-Windows-Connected-Search
Channel: Debug

Description

Starting to parse XML response of type: {Type}{Type}.

Message #

Starting to parse XML response of type: {Type}{Type}

Fields #

Name	Description
`Type`

Event ID 201: Finished parsing XML response of type: {Type}{Type} with result {Result}{Result}.

Provider: Microsoft-Windows-Connected-Search
Channel: Debug

Description

Finished parsing XML response of type: {Type}{Type} with result {Result}{Result}.

Message #

Finished parsing XML response of type: {Type}{Type} with result {Result}{Result}

Fields #

Name	Description
`Type`
`Result`

Event ID 202: Result set Impression Id {ImpressionId}{ImpressionId}.

Provider: Microsoft-Windows-Connected-Search
Channel: Debug

Description

Result set Impression Id {ImpressionId}{ImpressionId}.

Message #

Result set Impression Id {ImpressionId}{ImpressionId}

Fields #

Name	Description
`ImpressionId`

Event ID 203: Impression Id: {ImpressionId}{ImpressionId}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Impression Id: {ImpressionId}{ImpressionId}. item node encountered with object id: {ParserObjectId}{ParserObjectId} and sub-element id: {ParserSubElementId}{ParserSubElementId}.

Message #

Impression Id: {ImpressionId}{ImpressionId}. item node encountered with object id: {ParserObjectId}{ParserObjectId} and sub-element id: {ParserSubElementId}{ParserSubElementId}

Fields #

Name	Description
`ImpressionId`
`ParserObjectId`
`ParserSubElementId`

Event ID 204: Impression Id: {ImpressionId}{ImpressionId}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Message #

Impression Id: {ImpressionId}{ImpressionId}. {AttributeName}{AttributeName} attribute in namespace {Namespace}{Namespace} with value {Value}{Value} encountered with object id: {ParserObjectId}{ParserObjectId}

Fields #

Name	Description
`ImpressionId`
`AttributeName`
`Namespace`
`Value`
`ParserObjectId`

Event ID 205: Impression Id: {ImpressionId}{ImpressionId}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Impression Id: {ImpressionId}{ImpressionId}. Expando property {Property}{Property} set to value {Value}{Value} for object id: {ParserObjectId}{ParserObjectId}.

Message #

Impression Id: {ImpressionId}{ImpressionId}. Expando property {Property}{Property} set to value {Value}{Value} for object id: {ParserObjectId}{ParserObjectId}

Fields #

Name	Description
`ImpressionId`
`Property`
`Value`
`ParserObjectId`

Event ID 206: Impression Id: {ImpressionId}{ImpressionId}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Impression Id: {ImpressionId}{ImpressionId}. Mapped property {Property}{Property} set to value {Value}{Value} for object id: {ParserObjectId}{ParserObjectId}.

Message #

Impression Id: {ImpressionId}{ImpressionId}. Mapped property {Property}{Property} set to value {Value}{Value} for object id: {ParserObjectId}{ParserObjectId}

Fields #

Name	Description
`ImpressionId`
`Property`
`Value`
`ParserObjectId`

Event ID 207: Impression Id: {ImpressionId}{ImpressionId}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Message #

Impression Id: {ImpressionId}{ImpressionId}. extension node encountered with name {ElementName}{ElementName} with object id: {ParserObjectId}{ParserObjectId}; expando properties id {ExpandoPropertiesObjectId}{ExpandoPropertiesObjectId} and parent id: {ParentParserObjectId}{ParentParserObjectId}

Fields #

Name	Description
`ImpressionId`
`ElementName`
`ParserObjectId`
`ExpandoPropertiesObjectId`
`ParentParserObjectId`

Event ID 208: Impression Id: {ImpressionId}{ImpressionId}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Message #

Impression Id: {ImpressionId}{ImpressionId}. extension text node encountered with name {ElementName}{ElementName} with value {ElementValue}{ElementValue} for object id: {ParserObjectId}{ParserObjectId}

Fields #

Name	Description
`ImpressionId`
`ElementName`
`ElementValue`
`ParserObjectId`

Event ID 209: Impression Id: {ImpressionId}{ImpressionId}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Impression Id: {ImpressionId}{ImpressionId}. Channel extension node encountered with element name {ElementName}{ElementName}.

Message #

Impression Id: {ImpressionId}{ImpressionId}. Channel extension node encountered with element name {ElementName}{ElementName}

Fields #

Name	Description
`ImpressionId`
`ElementName`

Event ID 210: Impression Id: {ImpressionId}{ImpressionId}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Impression Id: {ImpressionId}{ImpressionId}. Channel extension text node encountered with element name {ElementName}{ElementName} and value {Value}{Value}.

Message #

Impression Id: {ImpressionId}{ImpressionId}. Channel extension text node encountered with element name {ElementName}{ElementName} and value {Value}{Value}

Fields #

Name	Description
`ImpressionId`
`ElementName`
`Value`

Event ID 211: Impression Id: {ImpressionId}{ImpressionId}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Impression Id: {ImpressionId}{ImpressionId}. XAML template {TemplateId}{TemplateId} referenced in results.

Message #

Impression Id: {ImpressionId}{ImpressionId}. XAML template {TemplateId}{TemplateId} referenced in results.

Fields #

Name	Description
`ImpressionId`
`TemplateId`

Event ID 212: Impression Id: {ImpressionId}{ImpressionId}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Impression Id: {ImpressionId}{ImpressionId}. XAML template {TemplateId}{TemplateId} referenced in results for prefetch.

Message #

Impression Id: {ImpressionId}{ImpressionId}. XAML template {TemplateId}{TemplateId} referenced in results for prefetch.

Fields #

Name	Description
`ImpressionId`
`TemplateId`

Event ID 213: Impression Id: {ImpressionId}{ImpressionId}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Impression Id: {ImpressionId}{ImpressionId}. XAML template {TemplateId}{TemplateId} referenced in results is an invalid identifier.

Message #

Impression Id: {ImpressionId}{ImpressionId}. XAML template {TemplateId}{TemplateId} referenced in results is an invalid identifier.

Fields #

Name	Description
`ImpressionId`
`TemplateId`

Event ID 214: Impression Id: {ImpressionId}{ImpressionId}.

Provider: Microsoft-Windows-Connected-Search
Channel: Debug

Description

Impression Id: {ImpressionId}{ImpressionId}. Query result is empty due to policy enforcement. {QueryBlocked}{QueryBlocked}. {Message}{Message}. {ShowSettings}{ShowSettings}.

Message #

Impression Id: {ImpressionId}{ImpressionId}. Query result is empty due to policy enforcement.  {QueryBlocked}{QueryBlocked}.  {Message}{Message}.  {ShowSettings}{ShowSettings}

Fields #

Name	Description
`ImpressionId`
`QueryBlocked`
`Message`
`ShowSettings`

Event ID 215: Failed parsing XML response of type: {Type}{Type} with result {Result}{Result}.

Provider: Microsoft-Windows-Connected-Search
Channel: Debug

Description

Failed parsing XML response of type: {Type}{Type} with result {Result}{Result}.

Message #

Failed parsing XML response of type: {Type}{Type} with result {Result}{Result}

Fields #

Name	Description
`Type`
`Result`

Event ID 216: Impression Id: {ImpressionId}{ImpressionId}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Impression Id: {ImpressionId}{ImpressionId}. Pre-fetch image {ImagePath}{ImagePath} referenced in results.

Message #

Impression Id: {ImpressionId}{ImpressionId}. Pre-fetch image {ImagePath}{ImagePath} referenced in results.

Fields #

Name	Description
`ImpressionId`
`ImagePath`

Event ID 217: Impression Id: {ImpressionId}{ImpressionId}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Impression Id: {ImpressionId}{ImpressionId}. Deferred Pre-fetch image {ImagePath}{ImagePath} referenced in results.

Message #

Impression Id: {ImpressionId}{ImpressionId}. Deferred Pre-fetch image {ImagePath}{ImagePath} referenced in results.

Fields #

Name	Description
`ImpressionId`
`ImagePath`

Event ID 300: Query Suggestions throttling minimum query length set to length {Length}{Length}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Query Suggestions throttling minimum query length set to length {Length}{Length}.

Message #

Query Suggestions throttling minimum query length set to length {Length}{Length}.

Fields #

Name	Description
`Length`

Event ID 301: Query Suggestions throttling timeout value set to value {Timeout}{Timeout}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Query Suggestions throttling timeout value set to value {Timeout}{Timeout}.

Message #

Query Suggestions throttling timeout value set to value {Timeout}{Timeout}.

Fields #

Name	Description
`Timeout`

Event ID 302: Query Suggestions throttling being applied for timeout {Timeout}{Timeout}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Query Suggestions throttling being applied for timeout {Timeout}{Timeout}.

Message #

Query Suggestions throttling being applied for timeout {Timeout}{Timeout}.

Fields #

Name	Description
`Timeout`

Event ID 303: Suggestions query term {QueryTerm}{QueryTerm} does not meet minimum query length {QueryLength}{QueryLength}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Suggestions query term {QueryTerm}{QueryTerm} does not meet minimum query length {QueryLength}{QueryLength}.

Message #

Suggestions query term {QueryTerm}{QueryTerm} does not meet minimum query length {QueryLength}{QueryLength}.

Fields #

Name	Description
`QueryTerm`
`QueryLength`

Event ID 400: Executing connected search query of type {Type}{Type}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Executing connected search query of type {Type}{Type}.

Message #

Executing connected search query of type {Type}{Type}

Fields #

Name	Description
`Type`

Event ID 401: Completed connected search query of type {Type}{Type} with result {Result}{Result}.

Provider: Microsoft-Windows-Connected-Search
Channel: Analytic

Description

Completed connected search query of type {Type}{Type} with result {Result}{Result}.

Message #

Completed connected search query of type {Type}{Type} with result {Result}{Result}

Fields #

Name	Description
`Type`
`Result`

Event ID 402: Connected search query of type {Type}{Type} failed with result {Result}{Result}.

Provider: Microsoft-Windows-Connected-Search
Channel: Debug

Description

Connected search query of type {Type}{Type} failed with result {Result}{Result}.

Message #

Connected search query of type {Type}{Type} failed with result {Result}{Result}

Fields #

Name	Description
`Type`
`Result`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)