Microsoft-Windows-DirectManipulation

64 events across 1 channel

Event	Title	Channel	Sample
26	Manipulation_SetInputStart	Diagnostic	N
27	Manipulation_SetInputStop	Diagnostic	N
28	Manipulation_SetContactStart	Diagnostic	N
29	Manipulation_SetContactStop	Diagnostic	N
30	Manipulation_EnumTargetsStart	Diagnostic	N
31	Manipulation_EnumTargetsStop	Diagnostic	N
32	Manipulation_ProcessInput_RegionUpdateStart	Diagnostic	N
33	Manipulation_ProcessInput_RegionUpdateStop	Diagnostic	N
34	Manipulation_ProcessInput_MotionUpdate	Diagnostic	N
36	Manipulation_ProcessInputInteractionStart	Diagnostic	N
37	Manipulation_ProcessInputInteractionStop	Diagnostic	N
38	Manipulation_LayerCommit	Diagnostic	N
39	Manipulation_RunningStart	Diagnostic	N
40	Manipulation_RunningStop	Diagnostic	N
41	Manipulation_InertiaStart	Diagnostic	N
42	Manipulation_InertiaStop	Diagnostic	N
43	Manipulation_DManipTrigger	Diagnostic	N
44	Manipulation_UpdateTransform	Diagnostic	N
45	Manipulation_ViewportAbandonStart	Diagnostic	N
46	Manipulation_ViewportAbandonStop	Diagnostic	N
47	Manipulation_DCompCompositorOnViewportStatusChangedStart	Diagnostic	N
48	Manipulation_DCompCompositorOnViewportStatusChangedStop	Diagnostic	N
49	Manipulation_DCompCompositorOnViewportUpdatedStart	Diagnostic	N
50	Manipulation_DCompCompositorOnViewportUpdatedStop	Diagnostic	N
51	Manipulation_DCompCompositorOnContentUpdatedStart	Diagnostic	N
52	Manipulation_DCompCompositorOnContentUpdatedStop	Diagnostic	N
53	Manipulation_DCompCompositorUpdateStart	Diagnostic	N
54	Manipulation_DCompCompositorUpdateStop	Diagnostic	N
55	Manipulation_ManagerActivateStart	Diagnostic	N
56	Manipulation_ManagerActivateStop	Diagnostic	N
57	Manipulation_ManagerDeactivateStart	Diagnostic	N
58	Manipulation_ManagerDeactivateStop	Diagnostic	N
59	Manipulation_ManagerCreateViewportStart	Diagnostic	N
60	Manipulation_ManagerCreateViewportStop	Diagnostic	N
61	Manipulation_ImplicitHitTestStart	Diagnostic	N
62	Manipulation_ImplicitHitTestStop	Diagnostic	N
63	Manipulation_ProcessBufferedQueueStart	Diagnostic	N
64	Manipulation_ProcessBufferedQueueStop	Diagnostic	N
65	Manipulation_ProcessAutoInputStart	Diagnostic	N
66	Manipulation_ProcessAutoInputStop	Diagnostic	N
67	Manipulation_Behaviors	Diagnostic	N
68	Manipulation_Behaviors68	Diagnostic	N
69	Manipulation_Behaviors69	Diagnostic	N
70	Manipulation_Behaviors70	Diagnostic	N
71	Manipulation_Prediction	Diagnostic	N
72	Manipulation_Inertia	Diagnostic	N
73	Manipulation_ParametricMotionStart	Diagnostic	N
74	Manipulation_ParametricMotionStop	Diagnostic	N
75	Manipulation_ParametricMotionStart75	Diagnostic	N
76	Manipulation_ParametricMotionStop76	Diagnostic	N
77	Manipulation_Inertia77	Diagnostic	N
78	Manipulation_ViewportEnable	Diagnostic	N
79	Manipulation_ViewportDisable	Diagnostic	N
80	Manipulation_ZoomToRect	Diagnostic	N
81	Manipulation_Storyboard	Diagnostic	N
82	Manipulation_PointerAssociation	Diagnostic	N
83	Manipulation_InputHandled	Diagnostic	N
84	Manipulation_Telemetry	Diagnostic	N
85	Manipulation_TelemetryStart	Diagnostic	N
86	Manipulation_Telemetry86	Diagnostic	N
87	Manipulation_TelemetryStop	Diagnostic	N
88	Manipulation_Telemetry88	Diagnostic	N
89	Manipulation_TurnOffInteraction	Diagnostic	N
90	Manipulation_TurnOnInteraction	Diagnostic	N

Event ID 26: Manipulation_SetInputStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_SetInput
Opcode: Start

Fields #

Name	Description
`PointerId` UInt32
`ContactId` UInt32

Event ID 27: Manipulation_SetInputStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_SetInput
Opcode: Stop

Fields #

Name	Description
`PointerId` UInt32
`ContactId` UInt32

Event ID 28: Manipulation_SetContactStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_SetContact
Opcode: Start

Fields #

Name	Description
`PointerId` UInt32
`RegionPointer` Pointer

Event ID 29: Manipulation_SetContactStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_SetContact
Opcode: Stop

Fields #

Name	Description
`PointerId` UInt32
`RegionPointer` Pointer

Event ID 30: Manipulation_EnumTargetsStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_EnumTargets
Opcode: Start

Fields #

Name	Description
`PointerId` UInt32
`ContactId` UInt32

Event ID 31: Manipulation_EnumTargetsStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_EnumTargets
Opcode: Stop

Fields #

Name	Description
`PointerId` UInt32
`ContactId` UInt32

Event ID 32: Manipulation_ProcessInput_RegionUpdateStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ProcessInput_RegionUpdate
Opcode: Start

Fields #

Name	Description
`PointerId` UInt32
`RegionPointer` Pointer

Event ID 33: Manipulation_ProcessInput_RegionUpdateStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ProcessInput_RegionUpdate
Opcode: Stop

Event ID 34: Manipulation_ProcessInput_MotionUpdate

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ProcessInput_MotionUpdate

Fields #

Name	Description
`MotionPointer` Pointer
`RegionPointer` Pointer
`LayerPointer` Pointer

Event ID 36: Manipulation_ProcessInputInteractionStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ProcessInputInteraction
Opcode: Start

Fields #

Name	Description
`PointerId` UInt32
`ContactId` UInt32

Event ID 37: Manipulation_ProcessInputInteractionStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ProcessInputInteraction
Opcode: Stop

Event ID 38: Manipulation_LayerCommit

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_LayerCommit

Fields #

Name	Description
`LayerPointer` Pointer

Event ID 39: Manipulation_RunningStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_Running
Opcode: Start

Fields #

Name	Description
`ViewportPointer` Pointer

Event ID 40: Manipulation_RunningStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_Running
Opcode: Stop

Fields #

Name	Description
`ViewportPointer` Pointer

Event ID 41: Manipulation_InertiaStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_Inertia
Opcode: Start

Fields #

Name	Description
`ViewportPointer` Pointer

Event ID 42: Manipulation_InertiaStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_Inertia
Opcode: Stop

Fields #

Name	Description
`ViewportPointer` Pointer

Event ID 43: Manipulation_DManipTrigger

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_DManipTrigger

Fields #

Name	Description
`DManipLatency` UInt32
`ProcessName` UnicodeString

Event ID 44: Manipulation_UpdateTransform

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_UpdateTransform

Fields #

Name	Description
`ContentPointer` Pointer
`TransformType` Int32
`xPosition` Float
`yPosition` Float
`zPosition` Float
`PredictedTimeGap` UInt64

Event ID 45: Manipulation_ViewportAbandonStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ViewportAbandon
Opcode: Start

Fields #

Name	Description
`ViewportPointer` Pointer

Event ID 46: Manipulation_ViewportAbandonStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ViewportAbandon
Opcode: Stop

Fields #

Name	Description
`ViewportPointer` Pointer

Event ID 47: Manipulation_DCompCompositorOnViewportStatusChangedStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_DCompCompositorOnViewportStatusChanged
Opcode: Start

Fields #

Name	Description
`CompositorPointer` Pointer
`ViewportPointer` Pointer
`CurrentStatus` Int32
`PreviousStatus` Int32

Event ID 48: Manipulation_DCompCompositorOnViewportStatusChangedStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_DCompCompositorOnViewportStatusChanged
Opcode: Stop

Fields #

Name	Description
`CompositorPointer` Pointer
`ViewportPointer` Pointer
`CurrentStatus` Int32
`PreviousStatus` Int32

Event ID 49: Manipulation_DCompCompositorOnViewportUpdatedStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_DCompCompositorOnViewportUpdated
Opcode: Start

Fields #

Name	Description
`CompositorPointer` Pointer
`ViewportPointer` Pointer

Event ID 50: Manipulation_DCompCompositorOnViewportUpdatedStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_DCompCompositorOnViewportUpdated
Opcode: Stop

Fields #

Name	Description
`CompositorPointer` Pointer
`ViewportPointer` Pointer

Event ID 51: Manipulation_DCompCompositorOnContentUpdatedStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_DCompCompositorOnContentUpdated
Opcode: Start

Fields #

Name	Description
`CompositorPointer` Pointer
`ContentPointer` Pointer

Event ID 52: Manipulation_DCompCompositorOnContentUpdatedStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_DCompCompositorOnContentUpdated
Opcode: Stop

Fields #

Name	Description
`CompositorPointer` Pointer
`ContentPointer` Pointer

Event ID 53: Manipulation_DCompCompositorUpdateStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_DCompCompositorUpdate
Opcode: Start

Fields #

Name	Description
`CompositorPointer` Pointer

Event ID 54: Manipulation_DCompCompositorUpdateStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_DCompCompositorUpdate
Opcode: Stop

Fields #

Name	Description
`CompositorPointer` Pointer

Event ID 55: Manipulation_ManagerActivateStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ManagerActivate
Opcode: Start

Fields #

Name	Description
`ManagerPointer` Pointer
`hWnd` Pointer

Event ID 56: Manipulation_ManagerActivateStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ManagerActivate
Opcode: Stop

Fields #

Name	Description
`ManagerPointer` Pointer
`hWnd` Pointer

Event ID 57: Manipulation_ManagerDeactivateStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ManagerDeactivate
Opcode: Start

Fields #

Name	Description
`ManagerPointer` Pointer
`hWnd` Pointer

Event ID 58: Manipulation_ManagerDeactivateStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ManagerDeactivate
Opcode: Stop

Fields #

Name	Description
`ManagerPointer` Pointer
`hWnd` Pointer

Event ID 59: Manipulation_ManagerCreateViewportStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ManagerCreateViewport
Opcode: Start

Fields #

Name	Description
`ManagerPointer` Pointer
`FrameInfo` Pointer
`hWnd` Pointer
`ViewportPointer` Pointer
`primaryContentPointer` Pointer

Event ID 60: Manipulation_ManagerCreateViewportStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ManagerCreateViewport
Opcode: Stop

Fields #

Name	Description
`ManagerPointer` Pointer
`FrameInfo` Pointer
`hWnd` Pointer
`ViewportPointer` Pointer
`primaryContentPointer` Pointer

Event ID 61: Manipulation_ImplicitHitTestStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ImplicitHitTest
Opcode: Start

Fields #

Name	Description
`ContactId` UInt32

Event ID 62: Manipulation_ImplicitHitTestStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ImplicitHitTest
Opcode: Stop

Fields #

Name	Description
`ContactId` UInt32

Event ID 63: Manipulation_ProcessBufferedQueueStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ProcessBufferedQueue
Opcode: Start

Fields #

Name	Description
`MessagesQueuedOrProcessed` Int32

Event ID 64: Manipulation_ProcessBufferedQueueStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ProcessBufferedQueue
Opcode: Stop

Fields #

Name	Description
`MessagesQueuedOrProcessed` Int32

Event ID 65: Manipulation_ProcessAutoInputStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ProcessAutoInput
Opcode: Start

Fields #

Name	Description
`PointerId` UInt32
`FrameId` UInt32
`Message` UInt32

Event ID 66: Manipulation_ProcessAutoInputStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ProcessAutoInput
Opcode: Stop

Fields #

Name	Description
`PointerId` UInt32
`FrameId` UInt32
`Message` UInt32

Event ID 67: Manipulation_Behaviors

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_Behaviors

Fields #

Name	Description
`content` Pointer
`dimension` Int32
`inertiaStartValue` Float
`originalRestPoint` Float
`outputRestPoint` Float
`outputRestPointPriority` Int32
`outputRestPointCurveId` Int32

Event ID 68: Manipulation_Behaviors68

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_Behaviors

Fields #

Name	Description
`content` Pointer
`motionType` Int32
`index` UInt32
`bIsNewSnapValues` Int32
`newSnapPointValue` Float

Event ID 69: Manipulation_Behaviors69

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_Behaviors

Fields #

Name	Description
`content` Pointer
`motionType` Int32
`interval` Float
`offset` Float

Event ID 70: Manipulation_Behaviors70

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_Behaviors

Fields #

Name	Description
`content` Pointer
`restPointX` Float
`restPointY` Float
`restPointZ` Float
`curveIdX` Int32
`curveIdY` Int32
`curveIdZ` Int32

Event ID 71: Manipulation_Prediction

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_Prediction

Fields #

Name	Description
`time` UInt64
`processTime` UInt64
`compositionTime` UInt64
`predictedTimeGap` UInt64
`predictionX` Float
`predictionY` Float

Event ID 72: Manipulation_Inertia

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_Inertia

Fields #

Name	Description
`inertiaStartTime` UInt64
`time` UInt64
`processTime` UInt64
`compositionTime` UInt64
`timerElapsedTime` Double
`timerOffset` Double
`animationTime` Double

Event ID 73: Manipulation_ParametricMotionStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ParametricMotion
Opcode: Start

Fields #

Name	Description
`content` Pointer
`targetMotionType` UInt32
`sourceMotionType` UInt32
`curveCount` UInt32

Event ID 74: Manipulation_ParametricMotionStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ParametricMotion
Opcode: Stop

Fields #

Name	Description
`content` Pointer

Event ID 75: Manipulation_ParametricMotionStart75

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ParametricMotion
Opcode: Start

Fields #

Name	Description
`content` Pointer
`inputScaleX` Float
`inputScaleY` Float
`inputTranslateX` Float
`inputTranslateY` Float

Event ID 76: Manipulation_ParametricMotionStop76

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ParametricMotion
Opcode: Stop

Fields #

Name	Description
`content` Pointer
`outputScaleX` Float
`outputScaleY` Float
`outputTranslateX` Float
`outputTranslateY` Float
`computedMotionTypes` UInt32

Event ID 77: Manipulation_Inertia77

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_Inertia

Fields #

Name	Description
`pNewValue` Double
`pOldValue` Double
`timeDeltaInMS` Double

Event ID 78: Manipulation_ViewportEnable

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ViewportEnable

Fields #

Name	Description
`ViewportPointer` Pointer

Event ID 79: Manipulation_ViewportDisable

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ViewportDisable

Fields #

Name	Description
`ViewportPointer` Pointer

Event ID 80: Manipulation_ZoomToRect

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_ZoomToRect

Fields #

Name	Description
`viewport` Pointer
`animate` Boolean

Event ID 81: Manipulation_Storyboard

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_Storyboard

Fields #

Name	Description
`storyboard` Pointer
`content` Pointer
`status` UInt32	NTSTATUS reference

Event ID 82: Manipulation_PointerAssociation

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_PointerAssociation

Fields #

Name	Description
`PointerId` UInt32
`ContactId` UInt32

Event ID 83: Manipulation_InputHandled

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_InputHandled

Fields #

Name	Description
`PointerId` UInt32
`FrameId` UInt32
`Message` UInt32

Event ID 84: Manipulation_Telemetry

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_Telemetry

Fields #

Name	Description
`UniqueKey` UInt64
`InertiaType` UInt32
`KernelInputReadTime` UInt64
`HostInputSendTime` UInt64
`ContainerInputReceiveTime` UInt64
`InteractionLibraryStartTime` UInt64
`CoalescedFrameCount` UInt32
`InputType` UInt32
`PointerCount` UInt16
`FrameId` UInt32
`ManipulationFrameId` UInt32
`ZoomToRectCount` UInt16
`Valid` Boolean
`InertiaZoom` Boolean

Event ID 85: Manipulation_TelemetryStart

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_Telemetry
Opcode: Start

Fields #

Name	Description
`AppUserModeId` UnicodeString
`AppType` UInt32
`InteractionLibraryType` UInt32
`UniqueKey` UInt64
`SurfaceWidth` UInt16
`SurfaceHeight` UInt16

Event ID 86: Manipulation_Telemetry86

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_Telemetry

Fields #

Name	Description
`UniqueKey` UInt64
`InputType` UInt32
`NumTouchPoints` UInt16
`ManipulationFrameId` UInt32
`FrameId` UInt32
`InteractionType` UInt32
`KernelInputStartTime` UInt64
`HostInputSendTime` UInt64
`ContainerInputReceiveTime` UInt64
`QpcInteractionLibraryStart` UInt64
`QpcInteractionLibraryStop` UInt64
`HostPerformanceFrequency` UInt64
`ZoomToRectCalls` UInt16
`CoalescedFrames` UInt32

Event ID 87: Manipulation_TelemetryStop

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_Telemetry
Opcode: Stop

Fields #

Name	Description
`UniqueKey` UInt64

Event ID 88: Manipulation_Telemetry88

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_Telemetry

Fields #

Name	Description
`InteractionLibraryStartTime` UInt64

Event ID 89: Manipulation_TurnOffInteraction

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_TurnOffInteraction

Fields #

Name	Description
`Viewport` Pointer
`Interaction` Pointer

Event ID 90: Manipulation_TurnOnInteraction

Provider: Microsoft-Windows-DirectManipulation
Channel: Diagnostic
Task: Manipulation_TurnOnInteraction

Fields #

Name	Description
`Viewport` Pointer
`Interaction` Pointer

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 5786e035-ef2d-4178-84f2-5a6bbedbb947

Defined in directmanipulation.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3451, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)