Microsoft-Windows-Energy-Estimation-Engine

49 events across 2 channels

Event	Title	Channel	Sample
1	InitializeProviderStart	EventLog	Y
2	InitializeProviderStop	Trace	N
3	UninitializeProvider	EventLog	Y
4	QueryStatsStart	Trace	N
5	QueryStatsStop	Trace	N
6	MergeStatsStart	Trace	N
7	MergeStatsStop	Trace	N
8	IndexToAppId	Trace	N
9	IndexToUserId	Trace	N
10	QueryColumnInfo	Trace	N
11	FreeMemory	Trace	N
12	QueryStatsEnergyEstimate	Trace	N
13	MergeStatsEnergyEstimate	Trace	N
14	QueryStatsCpuPowerInfo	Trace	N
15	QueryStatsProcessInfo	Trace	N
16	QueryStatsAppPerfInfo	Trace	N
17	QueryStatsEnergyDelta	Trace	N
18	QueryStatsEnergyDelta18	Trace	N
19	DisplayEnergyMonitorPowerState	Trace	N
20	DisplayEnergyPolicyBrightness	Trace	N
21	DisplayEnergyActualBrightness	Trace	N
22	QueryStatsResidualEnergy	Trace	N
23	QueryStatsResidualEnergy23	Trace	N
24	QueryStatsBatteryState	Trace	N
25	QueryStatsMapProcessToApp	Trace	N
26	QueryStatsAppForegroundTime	Trace	N
27	QueryStatsAppForegroundTime27	Trace	N
28	AppInteractivityState	Trace	N
29	AppInteractivityState29	Trace	N
30	AisResidencyDelta	Trace	N
31	AisResidencyDelta31	Trace	N
32	EnergyNotification	Trace	N
33	QueryStats	Trace	N
34	StandbyActivationTime	Trace	N
35	StandbyDripsTime	Trace	N
36	UnknownEnergy	Trace	N
37	QueryStatsEnergyEstimate37_V2	Trace	N
38	MergeStatsEnergyEstimate38_V2	Trace	N
39	CommittedStatsEnergyEstimate	Trace	N
40	ProcessTagEnergyEstimate_V1	Trace	N
41	RpcSetProcessTag	Trace	N
42	InitializeProviderDisplayTechnology	Trace	N
43	InitializeProviderDisplayModelInitStatus	Trace	N
44	InitializeProviderLcdRegistryValueUsingDefault	Trace	N
45	InitializeProviderLcdReadDwordFromRegistry	Trace	N
46	InitializeProviderBacklightMinimumPointCountError	Trace	N
47	InitializeProviderBacklightBrightnessRangeNot0to100	Trace	N
48	InitializeProviderBacklightPowerValueTooHighError	Trace	N
49	InitializeProviderBacklightPowerCurveError	Trace	N

Event ID 1: InitializeProviderStart

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: EventLog
Level: Informational
Task: InitializeProvider
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Energy-Estimation-Engine",
    "guid": "DDCC3826-A68A-4E0D-BCFD-9C06C27C6948",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 1,
    "keywords": 4611686018427387905,
    "time_created": "2026-03-13T20:05:06.399505+00:00",
    "event_record_id": 1,
    "correlation": {
      "ActivityID": "A5B814C5-B324-0008-B715-B8A524B3DC01"
    },
    "execution": {
      "process_id": 3832,
      "thread_id": 4664
    },
    "channel": "Microsoft-Windows-Energy-Estimation-Engine/EventLog",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 2: InitializeProviderStop

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: InitializeProvider
Opcode: Stop

Event ID 3: UninitializeProvider

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: EventLog
Level: Informational
Task: UninitializeProvider

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Energy-Estimation-Engine",
    "guid": "{DDCC3826-A68A-4E0D-BCFD-9C06C27C6948}",
    "event_source_name": "",
    "event_id": 3,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 4611686018427387905,
    "time_created": "2026-03-20T18:58:09.4178812+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 3740,
      "thread_id": 10532
    },
    "channel": "Microsoft-Windows-Energy-Estimation-Engine/EventLog",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 4: QueryStatsStart

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: QueryStats
Opcode: Start

Event ID 5: QueryStatsStop

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: QueryStats
Opcode: Stop

Event ID 6: MergeStatsStart

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: MergeStats
Opcode: Start

Event ID 7: MergeStatsStop

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: MergeStats
Opcode: Stop

Event ID 8: IndexToAppId

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: IndexToAppId

Event ID 9: IndexToUserId

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: IndexToUserId

Event ID 10: QueryColumnInfo

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: QueryColumnInfo

Event ID 11: FreeMemory

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: FreeMemory

Fields #

Name	Description
`DataType` UInt32
`Address` Pointer

Event ID 12: QueryStatsEnergyEstimate

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: QueryStats
Opcode: EnergyEstimate

Fields #

Name	Description
`AppName` UnicodeString
`UserId` UInt16
`CpuEnergy` UInt64
`SocEnergy` UInt64
`DisplayEnergy` UInt64
`DiskEnergy` UInt64
`NetworkEnergy` UInt64
`MbbEnergy` UInt64
`OtherEnergy` UInt64
`RecordFlags` UInt32

Event ID 13: MergeStatsEnergyEstimate

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: MergeStats
Opcode: EnergyEstimate

Fields #

Name	Description
`AppName` UnicodeString
`UserId` UInt16
`CpuEnergy` UInt64
`SocEnergy` UInt64
`DisplayEnergy` UInt64
`DiskEnergy` UInt64
`NetworkEnergy` UInt64
`MbbEnergy` UInt64
`OtherEnergy` UInt64
`RecordFlags` UInt32

Event ID 14: QueryStatsCpuPowerInfo

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: QueryStats
Opcode: CpuPowerInfo

Fields #

Name	Description
`CpuId` UInt32
`CurrentFrequency` UInt8
`LastBusyFrequency` UInt8
`Energy` UInt64

Event ID 15: QueryStatsProcessInfo

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: QueryStats
Opcode: ProcessInfo

Fields #

Name	Description
`SessionId` UInt32
`UniqueProcessId` UInt32
`ImageName` UnicodeString
`NumberOfThreads` UInt32
`CycleTime` UInt64
`ReadOperationCount` UInt64
`BytesRead` UInt64
`WriteOperationCount` UInt64
`BytesWritten` UInt64
`DiskEnergy` UInt64
`NetworkTailEnergy` UInt64
`MBBTailEnergy` UInt64
`NetworkTxRxBytes` UInt64
`MBBTxRxBytes` UInt64
`BucketCount` UInt32
`BucketedCycles` SID
`WindowInformation` UInt32
`ForegroundReportTimestamp` UInt64
`ForegroundTime` UInt64

Event ID 16: QueryStatsAppPerfInfo

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: QueryStats
Opcode: AppPerfInfo

Fields #

Name	Description
`UniqueApplicationId` UInt64
`PackageFullName` UnicodeString
`ForegroundCycleTime` UInt64
`BackgroundCycleTime` UInt64
`ForegroundActiveTime` UInt64
`ForegroundBytesRead` UInt64
`ForegroundBytesWritten` UInt64
`BackgroundBytesRead` UInt64
`BackgroundBytesWritten` UInt64
`BucketCount` UInt32
`ForegroundCycles` CountedUtf16String
`ForegroundDiskEnergy` UInt64
`ForegroundNetworkTailEnergy` UInt64
`ForegroundMBBTailEnergy` UInt64
`ForegroundNetworkTxRxBytes` UInt64
`ForegroundMBBTxRxBytes` UInt64
`BackgroundCycles` 25
`BackgroundDiskEnergy` UInt64
`BackgroundNetworkTailEnergy` UInt64
`BackgroundMBBTailEnergy` UInt64
`BackgroundNetworkTxRxBytes` UInt64
`BackgroundMBBTxRxBytes` UInt64

Event ID 17: QueryStatsEnergyDelta

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: QueryStats
Opcode: EnergyDelta

Fields #

Name	Description
`Component` UInt32
`EnergyDelta` UInt64

Event ID 18: QueryStatsEnergyDelta18

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: QueryStats
Opcode: EnergyDelta

Fields #

Name	Description
`Component` UInt32
`EnergyDelta` UInt64

Event ID 19: DisplayEnergyMonitorPowerState

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: DisplayEnergy
Opcode: MonitorPowerState

Fields #

Name	Description
`PreviousState` UInt8
`CurrentState` UInt8

Event ID 20: DisplayEnergyPolicyBrightness

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: DisplayEnergy
Opcode: PolicyBrightness

Fields #

Name	Description
`PreviousValue` UInt8
`CurrentValue` UInt8

Event ID 21: DisplayEnergyActualBrightness

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: DisplayEnergy
Opcode: ActualBrightness

Fields #

Name	Description
`PreviousValue` UInt8
`CurrentValue` UInt8

Event ID 22: QueryStatsResidualEnergy

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: QueryStats
Opcode: ResidualEnergy

Fields #

Name	Description
`BatteryDrain` UInt64
`EstimatedEnergy` UInt64
`ResidualEnergy` Int64

Event ID 23: QueryStatsResidualEnergy23

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: QueryStats
Opcode: ResidualEnergy

Fields #

Name	Description
`AgeInSec` UInt16
`AdjustedEnergy` UInt64
`ResidualEnergy` Int64

Event ID 24: QueryStatsBatteryState

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: QueryStats
Opcode: BatteryState

Fields #

Name	Description
`StateFlags` UInt32
`MaxCapacity` UInt32
`RemainingCapacity` UInt32
`Rate` UInt32
`EstimatedTime` UInt32

Event ID 25: QueryStatsMapProcessToApp

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: QueryStats
Opcode: MapProcessToApp

Fields #

Name	Description
`UniqueApplicationId` UInt64
`PackageFullName` UnicodeString
`SessionId` UInt32
`UniqueProcessId` UInt32
`ImageName` UnicodeString

Event ID 26: QueryStatsAppForegroundTime

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: QueryStats
Opcode: AppForegroundTime

Fields #

Name	Description
`UniqueApplicationId` UInt64
`ForegroundTime` UInt64

Event ID 27: QueryStatsAppForegroundTime27

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: QueryStats
Opcode: AppForegroundTime

Fields #

Name	Description
`UniqueApplicationId` UInt64
`ForegroundTimeDelta` UInt64

Event ID 28: AppInteractivityState

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: AppInteractivityState

Fields #

Name	Description
`UniqueProcessId` UInt32
`InteractivityState` UInt32

Event ID 29: AppInteractivityState29

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: AppInteractivityState

Fields #

Name	Description
`UniqueApplicationId` UInt64
`InteractivityState` UInt32

Event ID 30: AisResidencyDelta

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: AisResidencyDelta

Fields #

Name	Description
`UniqueProcessId` UInt32
`FcousTime` UInt64
`VisibleTime` UInt64
`MinimizedTime` UInt64
`DirtyGenerated` UInt32
`DirtyPropagated` UInt32
`CompositorRendered` UInt32

Event ID 31: AisResidencyDelta31

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: AisResidencyDelta

Fields #

Name	Description
`UniqueApplicationId` UInt64
`FcousTime` UInt64
`VisibleTime` UInt64
`MinimizedTime` UInt64
`DirtyGenerated` UInt32
`DirtyPropagated` UInt32
`CompositorRendered` UInt32

Event ID 32: EnergyNotification

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: EnergyNotification
Opcode: EnergyNotification

Fields #

Name	Description
`AppName` UnicodeString
`UserId` UInt16
`Cookie` UInt32
`BackgroundScreenOffmJ` UInt32
`BackgroundScreenOnmJ` UInt32
`ForegroundScreenOffmJ` UInt32
`ForegroundScreenOnmJ` UInt32

Event ID 33: QueryStats

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: QueryStats

Fields #

Name	Description
`SruWorkItemType` UInt32
`ProviderState` UInt32
`DeviceState` UInt32

Event ID 34: StandbyActivationTime

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: StandbyActivationTime
Opcode: StandbyActivationTime

Fields #

Name	Description
`PdcClientId` UInt16
`LastSnapValue` UInt64
`CurrSnapValue` UInt64
`Delta` UInt64

Event ID 35: StandbyDripsTime

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: StandbyDripsTime
Opcode: StandbyDripsTime

Fields #

Name	Description
`LastStandbyTotal` UInt64
`CurrStandbyTotal` UInt64
`DeltaStandbyTotal` UInt64
`LastDripsTotal` UInt64
`CurrDripsTotal` UInt64
`DeltaDripsTotal` UInt64
`LastActivationTotal` UInt64
`CurrActivationTotal` UInt64
`DeltaActivationTotal` UInt64

Event ID 36: UnknownEnergy

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: UnknownEnergy
Opcode: UnknownEnergy

Fields #

Name	Description
`TotalDuration` UInt64
`StandbyDuration` UInt64
`NonDripsDuration` UInt64
`PdcDuration` UInt64
`BIDuration` UInt64
`TargetedBIEnergy` UInt64
`ActualBIEnergy` UInt64
`UnknownEnergy` UInt64
`ScaleFactor` UInt64
`Policy` UInt32
`DripsPowerFloorMilliWatts` UInt32
`NonDripsPenaltyMilliWatts` UInt32

Event ID 37: QueryStatsEnergyEstimate37_V2

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: QueryStats
Opcode: EnergyEstimate

Fields #

Name	Description
`AppName` UnicodeString
`UserId` UInt16
`CpuEnergy` UInt64
`GpuEnergy` UInt64
`DisplayEnergy` UInt64
`DiskEnergy` UInt64
`NetworkEnergy` UInt64
`MbbEnergy` UInt64
`LossEnergy` UInt64
`OtherEnergy` UInt64
`EmiEnergy` UInt64
`ForInternalUse` UInt64
`TimeInMSec` UInt32
`RecordFlags` UInt32
`RecordMeasured` UInt32
`InteractivityState` UInt32
`Committed` UInt32
`WorkOnBehalfCPUEnergy` UInt64
`AttributedCPUEnergy` UInt64
`NpuEnergy` UInt64

Event ID 38: MergeStatsEnergyEstimate38_V2

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: MergeStats
Opcode: EnergyEstimate

Fields #

Name	Description
`AppName` UnicodeString
`UserId` UInt16
`CpuEnergy` UInt64
`GpuEnergy` UInt64
`DisplayEnergy` UInt64
`DiskEnergy` UInt64
`NetworkEnergy` UInt64
`MbbEnergy` UInt64
`LossEnergy` UInt64
`OtherEnergy` UInt64
`EmiEnergy` UInt64
`ForInternalUse` UInt64
`TimeInMSec` UInt32
`RecordFlags` UInt32
`RecordMeasured` UInt32
`InteractivityState` UInt32
`Committed` UInt32
`WorkOnBehalfCPUEnergy` UInt64
`AttributedCPUEnergy` UInt64
`NpuEnergy` UInt64

Event ID 39: CommittedStatsEnergyEstimate

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: CommittedStats
Opcode: EnergyEstimate

Fields #

Name	Description
`AppName` UnicodeString
`UserId` UInt16
`LossEnergy` UInt64
`UnknownEnergy` UInt64
`RecordFlags` UInt32
`InteractivityState` UInt32

Event ID 40: ProcessTagEnergyEstimate_V1

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: ProcessTagEnergyEstimate

Fields #

Name	Description
`AppName` UnicodeString
`Tag` UnicodeString
`CpuEnergy` UInt64
`DiskEnergy` UInt64
`NetworkEnergy` UInt64
`MbbEnergy` UInt64
`Time` UInt32
`RecordFlags` UInt32

Event ID 41: RpcSetProcessTag

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: RpcSetProcessTag

Fields #

Name	Description
`ProcessId` UInt32
`CreateTime` UInt64
`Tag` UnicodeString
`DiskEnergy` UInt64
`NetworkTailEnergy` UInt64
`MBBTailEnergy` UInt64
`NetworkTxRxBytes` UInt64
`MBBTxRxBytes` UInt64
`BucketCount` UInt32
`BucketedCycles` Float
`ErrorCode` UInt32

Event ID 42: InitializeProviderDisplayTechnology

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: InitializeProvider
Opcode: DisplayTechnology

Fields #

Name	Description
`DisplayTechnology` UInt32

Event ID 43: InitializeProviderDisplayModelInitStatus

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: InitializeProvider
Opcode: DisplayModelInitStatus

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 44: InitializeProviderLcdRegistryValueUsingDefault

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: InitializeProvider
Opcode: LcdRegistryValueUsingDefault

Fields #

Name	Description
`ValueName` UnicodeString
`DefaultValue` UInt32

Event ID 45: InitializeProviderLcdReadDwordFromRegistry

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: InitializeProvider
Opcode: LcdReadDwordFromRegistry

Fields #

Name	Description
`ValueName` UnicodeString
`RegistryValue` UInt32
`SetValue` UInt32
`MinimumValue` UInt32
`MaximumValue` UInt32

Event ID 46: InitializeProviderBacklightMinimumPointCountError

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: InitializeProvider
Opcode: BacklightMinimumPointCountError

Fields #

Name	Description
`PointCount` UInt32
`MinimumPointCount` UInt32

Event ID 47: InitializeProviderBacklightBrightnessRangeNot0to100

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: InitializeProvider
Opcode: BacklightBrightnessRangeNot0to100

Fields #

Name	Description
`FirstBrightnessPercent` UInt32
`LastBrightnessPercent` UInt32

Event ID 48: InitializeProviderBacklightPowerValueTooHighError

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: InitializeProvider
Opcode: BacklightPowerValueTooHighError

Fields #

Name	Description
`BacklightPower` UInt32
`MaximumBacklightPower` UInt32

Event ID 49: InitializeProviderBacklightPowerCurveError

Provider: Microsoft-Windows-Energy-Estimation-Engine
Channel: Trace
Task: InitializeProvider
Opcode: BacklightPowerCurveError

Fields #

Name	Description
`Index` UInt32
`CurrentBrightnessPercent` UInt32
`PreviousBrightnessPercent` UInt32
`CurrentBacklightPower` UInt32
`PreviousBacklightPower` UInt32
`MaximumBacklightPower` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID ddcc3826-a68a-4e0d-bcfd-9c06c27c6948

Defined in eeprov.dll, which carries the event manifest.

Observed on:

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02

Downloads

Microsoft-Windows-Energy-Estimation-Engine registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)