Microsoft-Windows-Folder Redirection

50 events across 2 channels

Event	Title	Channel	Sample
501	Successfully applied policy and redirected folder "FromFolder" to "ToFolder".	Application	N
502	Failed to apply policy and redirect folder "FromFolder" to "ToFolder".	Application	N
503	Failed to create KnownFolderManager.	Application	N
505	Failed to get destination path on policy removal for folder "Folder".	Application	N
506	Failed to update policy state for folder "Folder".	Application	N
507	Failed to delete policy state for folder "Folder".	Application	N
508	Failed to resolve path for folder "Folder".	Application	N
509	Failed to expand path for folder "Folder" path "Path".	Application	N
510	The folder redirection policy hasn't been applied.	Application	N
511	Failed to process policy info.	Application	N
512	Successfully removed policy and redirected folder "FromFolder" to "ToFolder".	Application	N
513	Failed to remove policy and redirect folder "FromFolder" to "ToFolder".	Application	N
514	Successfully removed policy for folder "Folder".	Application	N
515	Failed to remove policy for folder "Folder".	Application	N
516	Successfully applied policy to keep folder "Folder" at the same location.	Application	N
517	Failed to apply policy to keep folder "Folder" at the same location.	Application	N
1000	Folder Redirection Group Policy extension started.	Operational	N
1001	Folder Redirection Group Policy extension finished.	Operational	N
1002	Group Policy flags=GPFlags.	Operational	N
1003	Start Processing Group Policy Objects.	Operational	N
1004	Processing configuration file "ConfigurationFile" .	Operational	N
1005	Folder "Folder" was previously redirected.	Operational	N
1006	Folder "Folder" has to be redirected.	Operational	N
1007	No Folders were previously redirected.	Operational	N
1008	No Folders have to be redirected.	Operational	N
1009	Windows was unable to successfully evaluate whether this computer is a primary …	Operational	N
1010	This computer Result a primary computer for this user.	Operational	N
1011	Folder Redirection configuration is being controlled by Group Policy.	Operational	N
1012	Folder Redirection configuration is being controlled by WMI configuration class …	Operational	N
1073742824	Folder Redirection Group Policy extension started.	Operational	N
1073742825	Folder Redirection Group Policy extension finished.	Operational	N
1073742826	Group Policy flags=.	Operational	N
1073742827	Start Processing Group Policy Objects .	Operational	N
1073742828	Processing configuration file '{ConfigurationFile}' .	Operational	N
1073742829	Folder '{Folder}' was previously redirected.	Operational	N
1073742830	Folder '{Folder}' has to be redirected.	Operational	N
1073742831	No Folders were previously redirected.	Operational	N
1073742832	No Folders have to be redirected.	Operational	N
2147484158	Folder redirection policy application has been delayed until the next logon …	Operational	N
3221225974	Failed to apply policy and redirect folder '{FromFolder}' to '{ToFolder}'.	Operational	N
3221225975	Failed to create KnownFolderManager.	Operational	N
3221225977	Failed to get destination path on policy removal for folder '{Folder}'.	Operational	N
3221225978	Failed to update policy state for folder '{Folder}'.	Operational	N
3221225979	Failed to delete policy state for folder '{Folder}'.	Operational	N
3221225980	Failed to resolve path for folder '{Folder}'.	Operational	N
3221225981	Failed to expand path for folder '{Folder}' path '{Path}'.	Operational	N
3221225983	Failed to process policy info.	Operational	N
3221225985	Failed to remove policy and redirect folder '{FromFolder}' to '{ToFolder}'.	Operational	N
3221225987	Failed to remove policy for folder '{Folder}'.	Operational	N
3221225989	Failed to apply policy to keep folder '{Folder}' at the same location.	Operational	N

Event ID 501: Successfully applied policy and redirected folder "FromFolder" to "ToFolder".

Provider: Microsoft-Windows-Folder Redirection
Channel: Application

Description

Successfully applied policy and redirected folder "FromFolder" to "ToFolder".

Message #

Successfully applied policy and redirected folder "%1" to "%2".
 Redirection options=%3.

Fields #

Name	Description
`FromFolder` UnicodeString
`ToFolder` UnicodeString
`Options` HexInt32

Event ID 502: Failed to apply policy and redirect folder "FromFolder" to "ToFolder".

Provider: Microsoft-Windows-Folder Redirection
Channel: Application

Description

Failed to apply policy and redirect folder "FromFolder" to "ToFolder".

Message #

Failed to apply policy and redirect folder "%1" to "%2".
 Redirection options=%3.
 The following error occurred: "%4".
 Error details: "%5".

Fields #

Name	Description
`FromFolder` UnicodeString
`ToFolder` UnicodeString
`Options` HexInt32
`Error` UnicodeString
`ErrorDetails` UnicodeString

Event ID 503: Failed to create KnownFolderManager.

Provider: Microsoft-Windows-Folder Redirection
Channel: Application

Description

Failed to create KnownFolderManager. Folder redirection can not be performed.

Message #

Failed to create KnownFolderManager. Folder redirection can not be performed.
 Error details: "%1".

Fields #

Name	Description
`ErrorDetails` UnicodeString

Event ID 505: Failed to get destination path on policy removal for folder "Folder".

Provider: Microsoft-Windows-Folder Redirection
Channel: Application

Description

Failed to get destination path on policy removal for folder "Folder".

Message #

Failed to get destination path on policy removal for folder "%1".
 The folder redirection can not be removed.
 Error details: "%2".

Fields #

Name	Description
`Folder` UnicodeString
`ErrorDetails` UnicodeString

Event ID 506: Failed to update policy state for folder "Folder".

Provider: Microsoft-Windows-Folder Redirection
Channel: Application

Description

Failed to update policy state for folder "Folder".

Message #

Failed to update policy state for folder "%1".
 Error details: "%2".

Fields #

Name	Description
`Folder` UnicodeString
`ErrorDetails` UnicodeString

Event ID 507: Failed to delete policy state for folder "Folder".

Provider: Microsoft-Windows-Folder Redirection
Channel: Application

Description

Failed to delete policy state for folder "Folder".

Message #

Failed to delete policy state for folder "%1".
 Error details: "%2".

Fields #

Name	Description
`Folder` UnicodeString
`ErrorDetails` UnicodeString

Event ID 508: Failed to resolve path for folder "Folder".

Provider: Microsoft-Windows-Folder Redirection
Channel: Application

Description

Failed to resolve path for folder "Folder".

Message #

Failed to resolve path for folder "%1".
 Folder configuration is invalid or folder is configured to follow parent and the parent folder is not redirected. Folder can not be redirected.
 Error details: "%2".

Fields #

Name	Description
`Folder` UnicodeString
`ErrorDetails` UnicodeString

Event ID 509: Failed to expand path for folder "Folder" path "Path".

Provider: Microsoft-Windows-Folder Redirection
Channel: Application

Description

Failed to expand path for folder "Folder" path "Path".

Message #

Failed to expand path for folder "%1" path "%2".
 The folder can not be redirected.
 Error details: "%3".

Fields #

Name	Description
`Folder` UnicodeString
`Path` UnicodeString
`ErrorDetails` UnicodeString

Event ID 510: The folder redirection policy hasn't been applied.

Provider: Microsoft-Windows-Folder Redirection
Channel: Application

Description

The folder redirection policy hasn't been applied. It's been delayed until the next sign-in because the group policy sign-in optimization is in effect.

Message #

The folder redirection policy hasn't been applied. It's been delayed until the next sign-in because the group policy sign-in optimization is in effect.

Event ID 511: Failed to process policy info.

Provider: Microsoft-Windows-Folder Redirection
Channel: Application

Description

Failed to process policy info.

Message #

Failed to process policy info.
 Error details: "%1".

Fields #

Name	Description
`ErrorDetails` UnicodeString

Event ID 512: Successfully removed policy and redirected folder "FromFolder" to "ToFolder".

Provider: Microsoft-Windows-Folder Redirection
Channel: Application

Description

Successfully removed policy and redirected folder "FromFolder" to "ToFolder".

Message #

Successfully removed policy and redirected folder "%1" to "%2".
 Removal options=%3.

Fields #

Name	Description
`FromFolder` UnicodeString
`ToFolder` UnicodeString
`Options` HexInt32

Event ID 513: Failed to remove policy and redirect folder "FromFolder" to "ToFolder".

Provider: Microsoft-Windows-Folder Redirection
Channel: Application

Description

Failed to remove policy and redirect folder "FromFolder" to "ToFolder".

Message #

Failed to remove policy and redirect folder "%1" to "%2".
 Removal options=%3.
 The following error occurred: "%4".
 Error details: "%5".

Fields #

Name	Description
`FromFolder` UnicodeString
`ToFolder` UnicodeString
`Options` HexInt32
`Error` UnicodeString
`ErrorDetails` UnicodeString

Event ID 514: Successfully removed policy for folder "Folder".

Provider: Microsoft-Windows-Folder Redirection
Channel: Application

Description

Successfully removed policy for folder "Folder".

Message #

Successfully removed policy for folder "%1".
 Removal options=%2.

Fields #

Name	Description
`Folder` UnicodeString
`Options` HexInt32

Event ID 515: Failed to remove policy for folder "Folder".

Provider: Microsoft-Windows-Folder Redirection
Channel: Application

Description

Failed to remove policy for folder "Folder".

Message #

Failed to remove policy for folder "%1".
 Removal options=%2.
 The following error occurred: "%3".
 Error details: "%4".

Fields #

Name	Description
`Folder` UnicodeString
`Options` HexInt32
`Error` UnicodeString
`ErrorDetails` UnicodeString

Event ID 516: Successfully applied policy to keep folder "Folder" at the same location.

Provider: Microsoft-Windows-Folder Redirection
Channel: Application

Description

Successfully applied policy to keep folder "Folder" at the same location.

Message #

Successfully applied policy to keep folder "%1" at the same location.
 Redirection options=%2.

Fields #

Name	Description
`Folder` UnicodeString
`Options` HexInt32

Event ID 517: Failed to apply policy to keep folder "Folder" at the same location.

Provider: Microsoft-Windows-Folder Redirection
Channel: Application

Description

Failed to apply policy to keep folder "Folder" at the same location.

Message #

Failed to apply policy to keep folder "%1" at the same location.
 Redirection options=%2.
 The following error occurred: "%3".
 Error details: "%4".

Fields #

Name	Description
`Folder` UnicodeString
`Options` HexInt32
`Error` UnicodeString
`ErrorDetails` UnicodeString

Event ID 1000: Folder Redirection Group Policy extension started.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Folder Redirection Group Policy extension started.

Message #

Folder Redirection Group Policy extension started.

Event ID 1001: Folder Redirection Group Policy extension finished.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Folder Redirection Group Policy extension finished.

Message #

Folder Redirection Group Policy extension finished.

Event ID 1002: Group Policy flags=GPFlags.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Group Policy flags=GPFlags.

Message #

Group Policy flags=%1.

Fields #

Name	Description
`GPFlags` HexInt32

Event ID 1003: Start Processing Group Policy Objects.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Start Processing Group Policy Objects ...

Message #

Start Processing Group Policy Objects ...

Event ID 1004: Processing configuration file "ConfigurationFile" .

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Processing configuration file "ConfigurationFile" ...

Message #

Processing configuration file "%1" ...

Fields #

Name	Description
`ConfigurationFile` UnicodeString

Event ID 1005: Folder "Folder" was previously redirected.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Folder "Folder" was previously redirected.

Message #

Folder "%1" was previously redirected.
 Redirection options were = %2

Fields #

Name	Description
`Folder` UnicodeString
`Options` HexInt32

Event ID 1006: Folder "Folder" has to be redirected.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Folder "Folder" has to be redirected.

Message #

Folder "%1" has to be redirected.
 Redirection options = %2.
 Parent folder = "%3".
 Path = "%4".
 Group = %5.

Fields #

Name	Description
`Folder` UnicodeString
`Options` HexInt32
`ParentFolder` UnicodeString
`Path` UnicodeString
`Group` UnicodeString

Event ID 1007: No Folders were previously redirected.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

No Folders were previously redirected.

Message #

No Folders were previously redirected.

Event ID 1008: No Folders have to be redirected.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

No Folders have to be redirected.

Message #

No Folders have to be redirected.

Event ID 1009: Windows was unable to successfully evaluate whether this computer is a primary computer for this user.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Windows was unable to successfully evaluate whether this computer is a primary computer for this user. This may be due to failing to access the Active Directory server at this time. The user will have his or her redirected folders configured on this machine. Contact the Administrator for more assistance. Error: Error

Message #

Windows was unable to successfully evaluate whether this computer is a primary computer for this user. This may be due to failing to access the Active Directory server at this time. The user will have his or her redirected folders configured on this machine. Contact the Administrator for more assistance. Error: %1

Fields #

Name	Description
`Error` HexInt32

Event ID 1010: This computer Result a primary computer for this user.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

This computer Result a primary computer for this user.

Message #

This computer %1 a primary computer for this user.

Fields #

Name	Description
`Result` UnicodeString

Event ID 1011: Folder Redirection configuration is being controlled by Group Policy.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Folder Redirection configuration is being controlled by Group Policy.

Message #

Folder Redirection configuration is being controlled by Group Policy.

Event ID 1012: Folder Redirection configuration is being controlled by WMI configuration class Win32_FolderRedirectionUserConfiguration.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Folder Redirection configuration is being controlled by WMI configuration class Win32_FolderRedirectionUserConfiguration.

Message #

Folder Redirection configuration is being controlled by WMI configuration class Win32_FolderRedirectionUserConfiguration.

Event ID 1073742824: Folder Redirection Group Policy extension started.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Folder Redirection Group Policy extension started.

Message #

Folder Redirection Group Policy extension started.

Event ID 1073742825: Folder Redirection Group Policy extension finished.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Folder Redirection Group Policy extension finished.

Message #

Folder Redirection Group Policy extension finished.

Event ID 1073742826: Group Policy flags=.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Group Policy flags={GPFlags}.

Message #

Group Policy flags={GPFlags}.

Fields #

Name	Description
`GPFlags`

Event ID 1073742827: Start Processing Group Policy Objects .

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Start Processing Group Policy Objects ...

Message #

Start Processing Group Policy Objects ...

Event ID 1073742828: Processing configuration file '{ConfigurationFile}' .

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Processing configuration file '{ConfigurationFile}' ...

Message #

Processing configuration file '{ConfigurationFile}' ...

Fields #

Name	Description
`ConfigurationFile`

Event ID 1073742829: Folder '{Folder}' was previously redirected.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Folder '{Folder}' was previously redirected. Redirection options were = {Options}.

Message #

Folder '{Folder}' was previously redirected. Redirection options were = {Options}

Fields #

Name	Description
`Folder`
`Options`

Event ID 1073742830: Folder '{Folder}' has to be redirected.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Folder '{Folder}' has to be redirected. Redirection options = {Options}. Parent folder = '{ParentFolder}'. Path = '{Path}'. Group = {Group}.

Message #

Folder '{Folder}' has to be redirected. Redirection options = {Options}. Parent folder = '{ParentFolder}'. Path = '{Path}'. Group = {Group}.

Fields #

Name	Description
`Folder`
`Options`
`ParentFolder`
`Path`
`Group`

Event ID 1073742831: No Folders were previously redirected.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

No Folders were previously redirected.

Message #

No Folders were previously redirected.

Event ID 1073742832: No Folders have to be redirected.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

No Folders have to be redirected.

Message #

No Folders have to be redirected.

Event ID 2147484158: Folder redirection policy application has been delayed until the next logon because the group policy logon optimization is in effect.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Folder redirection policy application has been delayed until the next logon because the group policy logon optimization is in effect.

Message #

Folder redirection policy application has been delayed until the next logon because the group policy logon optimization is in effect.

Event ID 3221225974: Failed to apply policy and redirect folder '{FromFolder}' to '{ToFolder}'.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Failed to apply policy and redirect folder '{FromFolder}' to '{ToFolder}'. Redirection options={Options}. The following error occurred: '{Error}'. Error details: '{ErrorDetails}'.

Message #

Failed to apply policy and redirect folder '{FromFolder}' to '{ToFolder}'. Redirection options={Options}. The following error occurred: '{Error}'. Error details: '{ErrorDetails}'.

Fields #

Name	Description
`FromFolder`
`ToFolder`
`Options`
`Error`
`ErrorDetails`

Event ID 3221225975: Failed to create KnownFolderManager.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Failed to create KnownFolderManager. Folder redirection can not be performed. Error details: '{ErrorDetails}'.

Message #

Failed to create KnownFolderManager. Folder redirection can not be performed. Error details: '{ErrorDetails}'.

Fields #

Name	Description
`ErrorDetails`

Event ID 3221225977: Failed to get destination path on policy removal for folder '{Folder}'.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Failed to get destination path on policy removal for folder '{Folder}'. The folder redirection can not be removed. Error details: '{ErrorDetails}'.

Message #

Failed to get destination path on policy removal for folder '{Folder}'. The folder redirection can not be removed. Error details: '{ErrorDetails}'.

Fields #

Name	Description
`Folder`
`ErrorDetails`

Event ID 3221225978: Failed to update policy state for folder '{Folder}'.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Failed to update policy state for folder '{Folder}'. Error details: '{ErrorDetails}'.

Message #

Failed to update policy state for folder '{Folder}'. Error details: '{ErrorDetails}'.

Fields #

Name	Description
`Folder`
`ErrorDetails`

Event ID 3221225979: Failed to delete policy state for folder '{Folder}'.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Failed to delete policy state for folder '{Folder}'. Error details: '{ErrorDetails}'.

Message #

Failed to delete policy state for folder '{Folder}'. Error details: '{ErrorDetails}'.

Fields #

Name	Description
`Folder`
`ErrorDetails`

Event ID 3221225980: Failed to resolve path for folder '{Folder}'.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Message #

Failed to resolve path for folder '{Folder}'. Folder configuration is invalid or folder is configured to follow parent and the parent folder is not redirected. Folder can not be redirected. Error details: '{ErrorDetails}'.

Fields #

Name	Description
`Folder`
`ErrorDetails`

Event ID 3221225981: Failed to expand path for folder '{Folder}' path '{Path}'.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Failed to expand path for folder '{Folder}' path '{Path}'. The folder can not be redirected. Error details: '{ErrorDetails}'.

Message #

Failed to expand path for folder '{Folder}' path '{Path}'. The folder can not be redirected. Error details: '{ErrorDetails}'.

Fields #

Name	Description
`Folder`
`Path`
`ErrorDetails`

Event ID 3221225983: Failed to process policy info.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Failed to process policy info. Error details: '{ErrorDetails}'.

Message #

Failed to process policy info. Error details: '{ErrorDetails}'.

Fields #

Name	Description
`ErrorDetails`

Event ID 3221225985: Failed to remove policy and redirect folder '{FromFolder}' to '{ToFolder}'.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Failed to remove policy and redirect folder '{FromFolder}' to '{ToFolder}'. Removal options={Options}. The following error occurred: '{Error}'. Error details: '{ErrorDetails}'.

Message #

Failed to remove policy and redirect folder '{FromFolder}' to '{ToFolder}'. Removal options={Options}. The following error occurred: '{Error}'. Error details: '{ErrorDetails}'.

Fields #

Name	Description
`FromFolder`
`ToFolder`
`Options`
`Error`
`ErrorDetails`

Event ID 3221225987: Failed to remove policy for folder '{Folder}'.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Failed to remove policy for folder '{Folder}'. Removal options={Options}. The following error occurred: '{Error}'. Error details: '{ErrorDetails}'.

Message #

Failed to remove policy for folder '{Folder}'. Removal options={Options}. The following error occurred: '{Error}'. Error details: '{ErrorDetails}'.

Fields #

Name	Description
`Folder`
`Options`
`Error`
`ErrorDetails`

Event ID 3221225989: Failed to apply policy to keep folder '{Folder}' at the same location.

Provider: Microsoft-Windows-Folder Redirection
Channel: Operational

Description

Failed to apply policy to keep folder '{Folder}' at the same location. Redirection options={Options}. The following error occurred: '{Error}'. Error details: '{ErrorDetails}'.

Message #

Failed to apply policy to keep folder '{Folder}' at the same location. Redirection options={Options}. The following error occurred: '{Error}'. Error details: '{ErrorDetails}'.

Fields #

Name	Description
`Folder`
`Options`
`Error`
`ErrorDetails`

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 7d7b0c39-93f6-4100-bd96-4dda859652c5

Defined in fdeploy.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)