Microsoft-Windows-International

39 events across 1 channel

Event	Title	Channel	Sample
1001	The NLS operation failed because the registry key {RegistryKey} cannot be …	Operational	N
1002	The NLS operation failed because the registry key {RegistryKey} cannot be …	Operational	N
1003	NLS codepage operation failed for the codepage {CodePage} because the file …	Operational	N
1004	NLS codepage operation failed for the codepage {CodePage} because the file …	Operational	N
1005	NLS operation failed for {LocaleName} locale because the file …	Operational	N
1006	NLS operation failed for {LocaleName} locale because the file …	Operational	N
1500	Group Policy has prevented process number {ProcessId} ({ProdessName}) from …	Operational	N
1502	Group Policy has prevented the user from changing their user locale to …	Operational	N
1503	Group Policy does not allow custom user locales for standards and formats.	Operational	N
2000	NLS operation recreated the registry key {RegistryKey}.	Operational	N
3000	Process number {ProcessId} ({ProdessName}) called SetLocaleInfo({Locale}; …	Operational	N
3001	Process number {ProcessId} ({ProdessName}) called SetCalendarInfo({Locale}; …	Operational	N
3002	Process number {ProcessId} ({ProdessName}) called SetUserGeoID({GeoId}) …	Operational	N
3003	The system updated the locale '{LocaleName}' with flag {Flags}.	Operational	N
10000	The user tried to apply an unattended XML file ({FileName}) in an unsupported …	Operational	N
10003	The user locale '{LocaleName}' (specified by the UserLocale element) is not a …	Operational	N
10004	Unsupported alternate sort '{LocaleName}'.	Operational	N
10005	'.	Operational	N
10007	Internal error while changing System locale (specified by the SystemLocale …	Operational	N
10008	Error while changing keyboard/input method for '{LocaleName}'.	Operational	N
10009	Error while changing location preference (geoid): {Value}.	Operational	N
10010	Failed to change UI Language to '{LocaleName}'.	Operational	N
10011	Failed to change UI Language fallback order to '{LocaleName}'.	Operational	N
10012	The user tried to apply an unattended XML file {FileName}; but the file does not …	Operational	N
10013	Error while the user changed setting '{LCType}' with value '{Value}' for the …	Operational	N
10014	The selected calendar '{String};' (specified by the Calendar element) is not a …	Operational	N
10015	The selected TwoDigitYearMax '{String};' (specified by the TwoDigitYearMax …	Operational	N
10111	The user does not have permission to change the TwoDigitYearMax setting	Operational	N
10221	Failed when calling internal function.	Operational	N
13000	The user changed their user locale (specified by the UserLocale element) to …	Operational	N
13001	The user reset all customizations for their user locale '{LocaleName}' …	Operational	N
13002	The user changed their user locale setting '{LCType}' (specified by the …	Operational	N
13004	The user changed their alternate sort to '{LocaleName}'.	Operational	N
13005	The user changed their calendar to '{String}'.	Operational	N
13006	The user changed their TwoDigitYearMax to {String}.	Operational	N
13007	The user changed their location preference (geoid) to {Value}.	Operational	N
13008	The system locale (specified by the SystemLocale element) was changed to …	Operational	N
13011	The user has changed their UI Language to '{LocaleName}'.	Operational	N
13012	The user has changed their UI Language fallback order to '{LocaleName}'.	Operational	N

Event ID 1001: The NLS operation failed because the registry key {RegistryKey} cannot be opened.

Provider: Microsoft-Windows-International
Channel: Operational

Description

The NLS operation failed because the registry key {RegistryKey} cannot be opened. Error code is {ErrorCode}. Error message: {Message}.

Message #

The NLS operation failed because the registry key {RegistryKey} cannot be opened. Error code is {ErrorCode}. Error message: {Message}

Fields #

Name	Description
`RegistryKey`
`ErrorCode`
`Message`

Event ID 1002: The NLS operation failed because the registry key {RegistryKey} cannot be opened.

Provider: Microsoft-Windows-International
Channel: Operational

Description

The NLS operation failed because the registry key {RegistryKey} cannot be opened. Status code is {StatusCode}.

Message #

The NLS operation failed because the registry key {RegistryKey} cannot be opened. Status code is {StatusCode}.

Fields #

Name	Description
`RegistryKey`
`StatusCode`	NTSTATUS reference

Event ID 1003: NLS codepage operation failed for the codepage {CodePage} because the file {FileName} is missing.

Provider: Microsoft-Windows-International
Channel: Operational

Description

NLS codepage operation failed for the codepage {CodePage} because the file {FileName} is missing. To correct this error; replace this file or repair your Windows installation.

Message #

NLS codepage operation failed for the codepage {CodePage} because the file {FileName} is missing.  To correct this error; replace this file or repair your Windows installation.

Fields #

Name	Description
`CodePage`
`FileName`

Event ID 1004: NLS codepage operation failed for the codepage {CodePage} because the file {FileName} is corrupted.

Provider: Microsoft-Windows-International
Channel: Operational

Description

NLS codepage operation failed for the codepage {CodePage} because the file {FileName} is corrupted. To correct this error; replace this file or repair your Windows installation.

Message #

NLS codepage operation failed for the codepage {CodePage} because the file {FileName} is corrupted. To correct this error; replace this file or repair your Windows installation.

Fields #

Name	Description
`CodePage`
`FileName`

Event ID 1005: NLS operation failed for {LocaleName} locale because the file {WinDir}\globalization\{LocaleName}.

Provider: Microsoft-Windows-International
Channel: Operational

Description

NLS operation failed for {LocaleName} locale because the file {WinDir}\globalization\{LocaleName}.nlp is missing. To fix this problem; reinstall this custom locale.

Message #

NLS operation failed for {LocaleName} locale because the file {WinDir}\globalization\{LocaleName}.nlp is missing.  To fix this problem; reinstall this custom locale.

Fields #

Name	Description
`LocaleName`
`WinDir`

Event ID 1006: NLS operation failed for {LocaleName} locale because the file {WinDir}\globalization\{LocaleName}.

Provider: Microsoft-Windows-International
Channel: Operational

Description

NLS operation failed for {LocaleName} locale because the file {WinDir}\globalization\{LocaleName}.nlp is corrupted. To fix this problem; reinstall this custom locale.

Message #

NLS operation failed for {LocaleName} locale because the file {WinDir}\globalization\{LocaleName}.nlp is corrupted.  To fix this problem; reinstall this custom locale.

Fields #

Name	Description
`LocaleName`
`WinDir`

Event ID 1500: Group Policy has prevented process number {ProcessId} ({ProdessName}) from changing the standards and format information for the user.

Provider: Microsoft-Windows-International
Channel: Operational

Description

Group Policy has prevented process number {ProcessId} ({ProdessName}) from changing the standards and format information for the user.

Message #

Group Policy has prevented process number {ProcessId} ({ProdessName}) from changing the standards and format information for the user.

Fields #

Name	Description
`ProcessId`
`ProdessName`

Event ID 1502: Group Policy has prevented the user from changing their user locale to '{LocaleName}'.

Provider: Microsoft-Windows-International
Channel: Operational

Description

Group Policy has prevented the user from changing their user locale to '{LocaleName}'.

Message #

Group Policy has prevented the user from changing their user locale to '{LocaleName}'.

Fields #

Name	Description
`LocaleName`

Event ID 1503: Group Policy does not allow custom user locales for standards and formats.

Provider: Microsoft-Windows-International
Channel: Operational

Description

Group Policy does not allow custom user locales for standards and formats. The user was unable to select '{LocaleName}' as their user locale.

Message #

Group Policy does not allow custom user locales for standards and formats. The user was unable to select '{LocaleName}' as their user locale.

Fields #

Name	Description
`LocaleName`

Event ID 2000: NLS operation recreated the registry key {RegistryKey}.

Provider: Microsoft-Windows-International
Channel: Operational

Description

NLS operation recreated the registry key {RegistryKey}.

Message #

NLS operation recreated the registry key {RegistryKey}.

Fields #

Name	Description
`RegistryKey`

Event ID 3000: Process number {ProcessId} ({ProdessName}) called SetLocaleInfo({Locale}; {LCType}; '{lpLCData}') successfully.

Provider: Microsoft-Windows-International
Channel: Operational

Description

Process number {ProcessId} ({ProdessName}) called SetLocaleInfo({Locale}; {LCType}; '{lpLCData}') successfully.

Message #

Process number {ProcessId} ({ProdessName}) called SetLocaleInfo({Locale}; {LCType}; '{lpLCData}')  successfully.

Fields #

Name	Description
`ProcessId`
`ProdessName`
`Locale`
`LCType`
`lpLCData`

Event ID 3001: Process number {ProcessId} ({ProdessName}) called SetCalendarInfo({Locale}; {Calendar}; {CalType}; '{lpLCalData}') successfully.

Provider: Microsoft-Windows-International
Channel: Operational

Description

Process number {ProcessId} ({ProdessName}) called SetCalendarInfo({Locale}; {Calendar}; {CalType}; '{lpLCalData}') successfully.

Message #

Process number {ProcessId} ({ProdessName}) called SetCalendarInfo({Locale}; {Calendar}; {CalType}; '{lpLCalData}')  successfully.

Fields #

Name	Description
`ProcessId`
`ProdessName`
`Locale`
`Calendar`
`CalType`
`lpLCalData`

Event ID 3002: Process number {ProcessId} ({ProdessName}) called SetUserGeoID({GeoId}) successfully.

Provider: Microsoft-Windows-International
Channel: Operational

Description

Process number {ProcessId} ({ProdessName}) called SetUserGeoID({GeoId}) successfully.

Message #

Process number {ProcessId} ({ProdessName}) called SetUserGeoID({GeoId}) successfully.

Fields #

Name	Description
`ProcessId`
`ProdessName`
`GeoId`

Event ID 3003: The system updated the locale '{LocaleName}' with flag {Flags}.

Provider: Microsoft-Windows-International
Channel: Operational

Description

The system updated the locale '{LocaleName}' with flag {Flags}. Process number {ProcessId} ({ProdessName}). Return code is {ReturnCode}.

Message #

The system updated the locale '{LocaleName}' with flag {Flags}. Process number {ProcessId} ({ProdessName}). Return code is {ReturnCode}.

Fields #

Name	Description
`LocaleName`
`Flags`
`ProcessId`
`ProdessName`
`ReturnCode`

Event ID 10000: The user tried to apply an unattended XML file ({FileName}) in an unsupported format.

Provider: Microsoft-Windows-International
Channel: Operational

Description

The user tried to apply an unattended XML file ({FileName}) in an unsupported format. Reason: {Reason} (Line {LineNumber}). The system has not been changed.

Message #

The user tried to apply an unattended XML file ({FileName}) in an unsupported format. Reason: {Reason} (Line {LineNumber}). The system has not been changed.

Fields #

Name	Description
`FileName`
`Reason`
`LineNumber`

Event ID 10003: The user locale '{LocaleName}' (specified by the UserLocale element) is not a supported locale name or is not installed on the system.

Provider: Microsoft-Windows-International
Channel: Operational

Description

The user locale '{LocaleName}' (specified by the UserLocale element) is not a supported locale name or is not installed on the system. The user locale was not changed.

Message #

The user locale '{LocaleName}' (specified by the UserLocale element) is not a supported locale name or is not installed on the system. The user locale was not changed.

Fields #

Name	Description
`LocaleName`

Event ID 10004: Unsupported alternate sort '{LocaleName}'.

Provider: Microsoft-Windows-International
Channel: Operational

Description

Unsupported alternate sort '{LocaleName}'.

Message #

Unsupported alternate sort '{LocaleName}'.

Fields #

Name	Description
`LocaleName`

Event ID 10005: '.

Provider: Microsoft-Windows-International
Channel: Operational

Description

'{AltSort}' is not a supported sort order for locale '{Locale}'.

Message #

'{AltSort}' is not a supported sort order for locale '{Locale}'.

Fields #

Name	Description
`AltSort`
`Locale`

Event ID 10007: Internal error while changing System locale (specified by the SystemLocale element).

Provider: Microsoft-Windows-International
Channel: Operational

Description

Internal error while changing System locale (specified by the SystemLocale element).

Message #

Internal error while changing System locale (specified by the SystemLocale element).

Event ID 10008: Error while changing keyboard/input method for '{LocaleName}'.

Provider: Microsoft-Windows-International
Channel: Operational

Description

Error while changing keyboard/input method for '{LocaleName}'.

Message #

Error while changing keyboard/input method for '{LocaleName}'.

Fields #

Name	Description
`LocaleName`

Event ID 10009: Error while changing location preference (geoid): {Value}.

Provider: Microsoft-Windows-International
Channel: Operational

Message #

Error while changing location preference (geoid): {Value}. This error may be caused by an unsupported location preference (geoid) or a Group Policy restriction. Error code is {Win32ErrorCode}. Error message: {Win32ErrorMessage}

Fields #

Name	Description
`Value`
`Win32ErrorCode`
`Win32ErrorMessage`

Event ID 10010: Failed to change UI Language to '{LocaleName}'.

Provider: Microsoft-Windows-International
Channel: Operational

Description

Failed to change UI Language to '{LocaleName}'. Status code is: {StatusCode}.

Message #

Failed to change UI Language to '{LocaleName}'. Status code is: {StatusCode}.

Fields #

Name	Description
`LocaleName`
`StatusCode`	NTSTATUS reference

Event ID 10011: Failed to change UI Language fallback order to '{LocaleName}'.

Provider: Microsoft-Windows-International
Channel: Operational

Description

Failed to change UI Language fallback order to '{LocaleName}'. Status code is: {StatusCode}.

Message #

Failed to change UI Language fallback order to '{LocaleName}'. Status code is: {StatusCode}.

Fields #

Name	Description
`LocaleName`
`StatusCode`	NTSTATUS reference

Event ID 10012: The user tried to apply an unattended XML file {FileName}; but the file does not exist.

Provider: Microsoft-Windows-International
Channel: Operational

Description

The user tried to apply an unattended XML file {FileName}; but the file does not exist.

Message #

The user tried to apply an unattended XML file {FileName}; but the file does not exist.

Fields #

Name	Description
`FileName`

Event ID 10013: Error while the user changed setting '{LCType}' with value '{Value}' for the current user locale.

Provider: Microsoft-Windows-International
Channel: Operational

Description

Error while the user changed setting '{LCType}' with value '{Value}' for the current user locale. Error code is: {Win32ErrorCode}. Error message: {Win32ErrorMessage}.

Message #

Error while the user changed setting '{LCType}' with value '{Value}' for the current user locale. Error code is: {Win32ErrorCode}. Error message: {Win32ErrorMessage}

Fields #

Name	Description
`LCType`
`Value`
`Win32ErrorCode`
`Win32ErrorMessage`

Event ID 10014: The selected calendar '{String};' (specified by the Calendar element) is not a supported calendar.

Provider: Microsoft-Windows-International
Channel: Operational

Description

The selected calendar '{String};' (specified by the Calendar element) is not a supported calendar. The user locale was not changed.

Message #

The selected calendar '{String};' (specified by the Calendar element) is not a supported calendar. The user locale was not changed.

Fields #

Name	Description
`String`

Event ID 10015: The selected TwoDigitYearMax '{String};' (specified by the TwoDigitYearMax element) is not a supported value.

Provider: Microsoft-Windows-International
Channel: Operational

Description

The selected TwoDigitYearMax '{String};' (specified by the TwoDigitYearMax element) is not a supported value. The user locale was not changed.

Message #

The selected TwoDigitYearMax '{String};' (specified by the TwoDigitYearMax element) is not a supported value. The user locale was not changed.

Fields #

Name	Description
`String`

Event ID 10111: The user does not have permission to change the TwoDigitYearMax setting

Provider: Microsoft-Windows-International
Channel: Operational

Description

The user does not have permission to change the TwoDigitYearMax setting.

Message #

The user does not have permission to change the TwoDigitYearMax setting

Event ID 10221: Failed when calling internal function.

Provider: Microsoft-Windows-International
Channel: Operational

Description

Failed when calling internal function. Error code is: {StatusCode}.

Message #

Failed when calling internal function. Error code is: {StatusCode}

Fields #

Name	Description
`StatusCode`	NTSTATUS reference

Event ID 13000: The user changed their user locale (specified by the UserLocale element) to '{LocaleName}'.

Provider: Microsoft-Windows-International
Channel: Operational

Description

The user changed their user locale (specified by the UserLocale element) to '{LocaleName}'.

Message #

The user changed their user locale (specified by the UserLocale element) to '{LocaleName}'.

Fields #

Name	Description
`LocaleName`

Event ID 13001: The user reset all customizations for their user locale '{LocaleName}' (specified by the UserLocale element) to the system default.

Provider: Microsoft-Windows-International
Channel: Operational

Description

The user reset all customizations for their user locale '{LocaleName}' (specified by the UserLocale element) to the system default.

Message #

The user reset all customizations for their user locale '{LocaleName}' (specified by the UserLocale element) to the system default.

Fields #

Name	Description
`LocaleName`

Event ID 13002: The user changed their user locale setting '{LCType}' (specified by the UserLocale element) to '{Value}'.

Provider: Microsoft-Windows-International
Channel: Operational

Description

The user changed their user locale setting '{LCType}' (specified by the UserLocale element) to '{Value}'.

Message #

The user changed their user locale setting '{LCType}' (specified by the UserLocale element) to '{Value}'.

Fields #

Name	Description
`LCType`
`Value`

Event ID 13004: The user changed their alternate sort to '{LocaleName}'.

Provider: Microsoft-Windows-International
Channel: Operational

Description

The user changed their alternate sort to '{LocaleName}'.

Message #

The user changed their alternate sort to '{LocaleName}'.

Fields #

Name	Description
`LocaleName`

Event ID 13005: The user changed their calendar to '{String}'.

Provider: Microsoft-Windows-International
Channel: Operational

Description

The user changed their calendar to '{String}'.

Message #

The user changed their calendar to '{String}'.

Fields #

Name	Description
`String`

Event ID 13006: The user changed their TwoDigitYearMax to {String}.

Provider: Microsoft-Windows-International
Channel: Operational

Description

The user changed their TwoDigitYearMax to {String}.

Message #

The user changed their TwoDigitYearMax to {String}.

Fields #

Name	Description
`String`

Event ID 13007: The user changed their location preference (geoid) to {Value}.

Provider: Microsoft-Windows-International
Channel: Operational

Description

The user changed their location preference (geoid) to {Value}.

Message #

The user changed their location preference (geoid) to {Value}.

Fields #

Name	Description
`Value`

Event ID 13008: The system locale (specified by the SystemLocale element) was changed to '{LocaleName}'.

Provider: Microsoft-Windows-International
Channel: Operational

Description

The system locale (specified by the SystemLocale element) was changed to '{LocaleName}'.

Message #

The system locale (specified by the SystemLocale element) was changed to '{LocaleName}'.

Fields #

Name	Description
`LocaleName`

Event ID 13011: The user has changed their UI Language to '{LocaleName}'.

Provider: Microsoft-Windows-International
Channel: Operational

Description

The user has changed their UI Language to '{LocaleName}'.

Message #

The user has changed their UI Language to '{LocaleName}'.

Fields #

Name	Description
`LocaleName`

Event ID 13012: The user has changed their UI Language fallback order to '{LocaleName}'.

Provider: Microsoft-Windows-International
Channel: Operational

Description

The user has changed their UI Language fallback order to '{LocaleName}'.

Message #

The user has changed their UI Language fallback order to '{LocaleName}'.

Fields #

Name	Description
`LocaleName`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)