Microsoft-Windows-Kernel-Acpi

35 events across 1 channel

Event	Title	Channel	Sample
1	A memory range descriptor has been marked as reserved.	Diagnostic	N
2	Unexpected GPE event was fired on GPE bits that should be disabled.	Diagnostic	N
3	A temperature change notification (Notify(thermal_zone, 0x80)) for ACPI thermal …	Diagnostic	N
4	A trip point change notification (Notify(thermal_zone, 0x81)) for ACPI thermal …	Diagnostic	N
5	The active cooling device FanDeviceInstanceLength has been turned …	Diagnostic	N
6	The active cooling device FanDeviceInstanceLength has been turned …	Diagnostic	N
7	ACPI method AmlMethodName evaluation has AmlMethodState.	Diagnostic	N
8	The active cooling device DeviceInstance has been turned PowerState.	Diagnostic	N
9	The passive cooling device DeviceInstance throttle has changed to Throttle …	Diagnostic	N
10	The device Passive_cooling has the following cooling state.	Diagnostic	N
11	TemperatureChange	Diagnostic	N
12	ThermalZoneRundown_V4	Diagnostic	N
13	FanRundown	Diagnostic	N
14	FanPowerStateChange	Diagnostic	N
15	FanStatusChange	Diagnostic	N
16	ActiveCoolingConstraint	Diagnostic	N
17	ActiveCoolingConstraintRundown	Diagnostic	N
18	PassiveCoolingConstraint	Diagnostic	N
19	PassiveCoolingConstraintRundown	Diagnostic	N
20	ACPI device DeviceBiosName is undergoing DeviceResetType.	Diagnostic	N
21	ACPI device OverRide - AcpiOverrideType.	Diagnostic	N
22	Error occured while interpreting AML code: scope Scope, object Object.	Diagnostic	N
23	ACPI method AmlMethodName has high frequency Frequency.	Diagnostic	N
24	A button notification for ACPI button ButtonDeviceInstance has been received.	Diagnostic	N
25	A button IRP for ACPI button ButtonDeviceInstance has been completed.	Diagnostic	N
26	PccSubspaceRundown	Diagnostic	N
27	PccEjectSubspace	Diagnostic	N
28	PccAcquireSubspace	Diagnostic	N
29	PccReleaseSubspace	Diagnostic	N
30	PccExecuteCommand	Diagnostic	N
31	PccCommandComplete	Diagnostic	N
32	PccCommandTimeout	Diagnostic	N
33	PccPlatformInterrupt	Diagnostic	N
34	The strict S4 enforcement _DSM failed evaluation.	Diagnostic	N
35	MsStateNotification	Diagnostic	N

Event ID 1: A memory range descriptor has been marked as reserved.

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: ResourceTranslation

Description

A memory range descriptor has been marked as reserved.

Message #

A memory range descriptor has been marked as reserved.

Fields #

Name	Description
`ResourceFlag` UInt8
`GeneralFlag` UInt8
`TypeSpecificFlag` UInt8
`Granularity` UInt64
`AddressMin` UInt64
`AddressMax` UInt64
`AddressTranslation` UInt64
`AddressLength` UInt64

Event ID 2: Unexpected GPE event was fired on GPE bits that should be disabled.

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: GpeEventHandling

Description

Unexpected GPE event was fired on GPE bits that should be disabled.

Message #

Unexpected GPE event was fired on GPE bits that should be disabled.

Fields #

Name	Description
`GpeRegister` UInt32
`UnexpectedEventMap` UInt8

Event ID 3: A temperature change notification (Notify(thermal_zone, 0x80)) for ACPI thermal zone ThermalZoneDeviceInstance has been received.

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: TemperatureNotification

Description

A temperature change notification (Notify(thermal_zone, 0x80)) for ACPI thermal zone ThermalZoneDeviceInstance has been received.

Message #

A temperature change notification (Notify(thermal_zone, 0x80)) for ACPI thermal zone %2 has been received.             
_TMP = %3K             
_PSV = %4K             
_AC0 = %5K             
_AC1 = %6K             
_AC2 = %7K             
_AC3 = %8K             
_AC4 = %9K             
_AC5 = %10K             
_AC6 = %11K             
_AC7 = %12K             
_AC8 = %13K             
_AC9 = %14K             
_HOT = %15K             
_CRT = %16K

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`_TMP` UInt32
`_PSV` UInt32
`_AC0` UInt32
`_AC1` UInt32
`_AC2` UInt32
`_AC3` UInt32
`_AC4` UInt32
`_AC5` UInt32
`_AC6` UInt32
`_AC7` UInt32
`_AC8` UInt32
`_AC9` UInt32
`_HOT` UInt32
`_CRT` UInt32

Event ID 4: A trip point change notification (Notify(thermal_zone, 0x81)) for ACPI thermal zone ThermalZoneDeviceInstance has been received.

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: TripPointNotification

Description

A trip point change notification (Notify(thermal_zone, 0x81)) for ACPI thermal zone ThermalZoneDeviceInstance has been received.

Message #

A trip point change notification (Notify(thermal_zone, 0x81)) for ACPI thermal zone %2 has been received.             
_TMP = %3K             
_PSV = %4K             
_AC0 = %5K             
_AC1 = %6K             
_AC2 = %7K             
_AC3 = %8K             
_AC4 = %9K             
_AC5 = %10K             
_AC6 = %11K             
_AC7 = %12K             
_AC8 = %13K             
_AC9 = %14K             
_HOT = %15K             
_CRT = %16K

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`_TMP` UInt32
`_PSV` UInt32
`_AC0` UInt32
`_AC1` UInt32
`_AC2` UInt32
`_AC3` UInt32
`_AC4` UInt32
`_AC5` UInt32
`_AC6` UInt32
`_AC7` UInt32
`_AC8` UInt32
`_AC9` UInt32
`_HOT` UInt32
`_CRT` UInt32

Event ID 5: The active cooling device FanDeviceInstanceLength has been turned PowerStateLength.

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: ActiveCoolingDevicePower

Description

The active cooling device FanDeviceInstanceLength has been turned PowerStateLength.

Message #

The active cooling device %6 has been turned %8.             
Thermal zone device instance: %2             
Active cooling package: _AC%3             
Namespace object: _AL%4

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`ActiveCoolingLevel` UInt32
`ActiveCoolingDeviceIndex` UInt32
`FanDeviceInstanceLength` UInt16
`FanDeviceInstance` UnicodeString
`PowerStateLength` UInt16
`PowerState` UnicodeString

Event ID 6: The active cooling device FanDeviceInstanceLength has been turned FanDeviceInstance.

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: ActiveCoolingDevicePower

Description

The active cooling device FanDeviceInstanceLength has been turned FanDeviceInstance.

Message #

The active cooling device %6 has been turned %7.             
Thermal zone device instance: %2             
Active cooling package: _AC%3             
Namespace object: _AL%4

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`ActiveCoolingLevel` UInt32
`ActiveCoolingDeviceIndex` UInt32
`FanDeviceInstanceLength` UInt16
`FanDeviceInstance` UnicodeString
`PowerState` UInt16

Event ID 7: ACPI method AmlMethodName evaluation has AmlMethodState.

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: AmlMethodTrace

Description

ACPI method AmlMethodName evaluation has AmlMethodState.

Message #

ACPI method %2 evaluation has %3.

Fields #

Name	Description
`AmlMethodNameLength` UInt16
`AmlMethodName` UnicodeString
`AmlMethodState` UInt16
`AmlElapsedTime` UInt64

Event ID 8: The active cooling device DeviceInstance has been turned PowerState.

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: DeviceActiveCooling

Description

The active cooling device DeviceInstance has been turned PowerState.

Message #

The active cooling device %2 has been turned %3.

Fields #

Name	Description
`DeviceInstanceLength` UInt16
`DeviceInstance` UnicodeString
`PowerState` UInt16

Event ID 9: The passive cooling device DeviceInstance throttle has changed to Throttle percent.

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: DevicePassiveCooling

Description

The passive cooling device DeviceInstance throttle has changed to Throttle percent.

Message #

The passive cooling device %2 throttle has changed to %3 percent.

Fields #

Name	Description
`DeviceInstanceLength` UInt16
`DeviceInstance` UnicodeString
`Throttle` UInt8

Event ID 10: The device Passive_cooling has the following cooling state.

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: DeviceCoolingRundown

Description

The device Passive_cooling has the following cooling state.

Message #

The device %2 has the following cooling state.             
Active cooling: %3             
Passive cooling: %4 percent

Fields #

Name	Description
`DeviceInstanceLength` UInt16
`DeviceInstance` UnicodeString
`PowerState` UInt16
`Throttle` UInt8

Event ID 11: TemperatureChange

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: TemperatureChange

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`Temperature` UInt32

Event ID 12: ThermalZoneRundown_V4

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: ThermalZoneRundown

Fields #

Name	Description
`ThermalZoneBiosNameLength` UInt16
`ThermalZoneBiosName` UnicodeString
`_TMP` UInt32
`_PSV` UInt32
`_TC1` UInt32
`_TC2` UInt32
`_TSP` UInt32
`_AC0` UInt32
`_AC1` UInt32
`_AC2` UInt32
`_AC3` UInt32
`_AC4` UInt32
`_AC5` UInt32
`_AC6` UInt32
`_AC7` UInt32
`_AC8` UInt32
`_AC9` UInt32
`_HOT` UInt32
`_CRT` UInt32
`_NTT` UInt32
`_PSLCount` UInt32
`_PSLEntries` AnsiString
`_TZDCount` UInt32
`_TZDEntries` AnsiString
`_AL0Count` UInt32
`_AL0Entries` AnsiString
`_AL1Count` UInt32
`_AL1Entries` AnsiString
`_AL2Count` UInt32
`_AL2Entries` AnsiString
`_AL3Count` UInt32
`_AL3Entries` AnsiString
`_AL4Count` UInt32
`_AL4Entries` AnsiString
`_AL5Count` UInt32
`_AL5Entries` AnsiString
`_AL6Count` UInt32
`_AL6Entries` AnsiString
`_AL7Count` UInt32
`_AL7Entries` AnsiString
`_AL8Count` UInt32
`_AL8Entries` AnsiString
`_AL9Count` UInt32
`_AL9Entries` AnsiString
`MinimumThrottle` UInt32
`_CR3` UInt32
`_TFP` UInt32
`OverThrottleThreshold` UInt32
`DescriptionLength` UInt16
`Description` UnicodeString
`_TZP` UInt32

Event ID 13: FanRundown

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: FanRundown

Fields #

Name	Description
`FanBiosNameLength` UInt16
`FanBiosName` UnicodeString
`FstSupported` Boolean
`PowerState` UInt16
`Control` UInt32
`Speed` UInt32

Event ID 14: FanPowerStateChange

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: FanPowerStateChange

Fields #

Name	Description
`FanBiosNameLength` UInt16
`FanBiosName` UnicodeString
`PowerState` UInt16

Event ID 15: FanStatusChange

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: FanStatusChange

Fields #

Name	Description
`FanBiosNameLength` UInt16
`FanBiosName` UnicodeString
`Control` UInt32
`Speed` UInt32

Event ID 16: ActiveCoolingConstraint

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: ActiveCoolingConstraint

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`DeviceInstanceLength` UInt16
`DeviceInstance` UnicodeString
`PowerState` UInt16

Event ID 17: ActiveCoolingConstraintRundown

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: ActiveCoolingConstraintRundown

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`DeviceInstanceLength` UInt16
`DeviceInstance` UnicodeString
`PowerState` UInt16

Event ID 18: PassiveCoolingConstraint

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: PassiveCoolingConstraint

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`DeviceInstanceLength` UInt16
`DeviceInstance` UnicodeString
`ThrottleLimit` UInt8

Event ID 19: PassiveCoolingConstraintRundown

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: PassiveCoolingConstraintRundown

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`DeviceInstanceLength` UInt16
`DeviceInstance` UnicodeString
`ThrottleLimit` UInt8

Event ID 20: ACPI device DeviceBiosName is undergoing DeviceResetType.

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: DeviceReset

Description

ACPI device DeviceBiosName is undergoing DeviceResetType. Status Status.

Message #

ACPI device %2 is undergoing %3. Status %4.

Fields #

Name	Description
`DeviceBiosNameLength` UInt16
`DeviceBiosName` UnicodeString
`DeviceResetType` UInt16
`Status` UInt32	NTSTATUS reference

Event ID 21: ACPI device OverRide - AcpiOverrideType.

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: AcpiOverride

Description

ACPI device OverRide - AcpiOverrideType.

Message #

ACPI device OverRide - %1

Fields #

Name	Description
`AcpiOverrideType` UInt16

Event ID 22: Error occured while interpreting AML code: scope Scope, object Object.

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: AMLIError

Description

Error occured while interpreting AML code: scope Scope, object Object. Status Status.

Message #

Error occured while interpreting AML code: scope %1, object %2. Status %3.

Fields #

Name	Description
`Scope` UnicodeString
`Object` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 23: ACPI method AmlMethodName has high frequency Frequency.

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: FrequentAmlMethod

Description

ACPI method AmlMethodName has high frequency Frequency.

Message #

ACPI method %2 has high frequency %3.

Fields #

Name	Description
`AmlMethodNameLength` UInt16
`AmlMethodName` UnicodeString
`Frequency` UInt64

Event ID 24: A button notification for ACPI button ButtonDeviceInstance has been received.

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: ButtonNotification

Description

A button notification for ACPI button ButtonDeviceInstance has been received. Capabilities = Capabilities, EventMask = EventMask.

Message #

A button notification for ACPI button %2 has been received. Capabilities = %3, EventMask = %4.

Fields #

Name	Description
`ButtonDeviceInstanceLength` UInt16
`ButtonDeviceInstance` UnicodeString
`Capabilities` HexInt32
`EventMask` HexInt32

Event ID 25: A button IRP for ACPI button ButtonDeviceInstance has been completed.

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: ButtonIrpCompletion

Description

A button IRP for ACPI button ButtonDeviceInstance has been completed. EventMask = EventMask, IRP = Irp.

Message #

A button IRP for ACPI button %2 has been completed. EventMask = %3, IRP = %4.

Fields #

Name	Description
`ButtonDeviceInstanceLength` UInt16
`ButtonDeviceInstance` UnicodeString
`EventMask` HexInt32
`Irp` UInt64

Event ID 26: PccSubspaceRundown

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: PccSubspaceRundown

Fields #

Name	Description
`Type34SupportEnabled` UInt32
`SubspaceId` UInt32
`Type` UInt8
`State` UInt8
`InterruptSupported` UInt8
`InterruptFlags` UInt8
`GSIV` UInt32
`NominalLatency` UInt32
`AdvertisedNominalLatency` UInt32
`MaxPeriodicAccessRate` UInt32
`MinRequestTurnaroundTime` UInt32
`InitFailure` UInt32
`EjectFailure` UInt32
`WDTimeoutCount` UInt32
`WDTimerAttributes` UInt32
`SharedRegionPhysicalAddress` UInt64
`SharedRegionLength` UInt32
`RegisterCount` UInt32
`Registers` SID

Event ID 27: PccEjectSubspace

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: PccEjectSubspace

Fields #

Name	Description
`SubspaceId` UInt32
`Type` UInt8
`Result` UInt32
`EjectFailure` UInt32
`InitFailure` UInt32

Event ID 28: PccAcquireSubspace

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: PccAcquireSubspace

Fields #

Name	Description
`SubspaceId` UInt32
`PrevState` UInt8
`NewState` UInt8
`SyncAcquire` UInt32
`Result` UInt32

Event ID 29: PccReleaseSubspace

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: PccReleaseSubspace

Fields #

Name	Description
`SubspaceId` UInt32
`PrevState` UInt8
`NewState` UInt8
`Result` UInt32

Event ID 30: PccExecuteCommand

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: PccExecuteCommand

Fields #

Name	Description
`SubspaceId` UInt32
`Command` UInt8
`PrevState` UInt8
`NewState` UInt8
`DelayTimeInUs` UInt64
`Result` UInt32

Event ID 31: PccCommandComplete

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: PccCommandComplete

Fields #

Name	Description
`SubspaceId` UInt32
`Command` UInt8
`CommandInProgress` UInt32
`PrevState` UInt8
`NewState` UInt8
`Error` UInt64
`Result` UInt32

Event ID 32: PccCommandTimeout

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: PccCommandTimeout

Fields #

Name	Description
`SubspaceId` UInt32
`AccumulatedFailureCount` UInt32

Event ID 33: PccPlatformInterrupt

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: PccPlatformInterrupt

Fields #

Name	Description
`GSIV` UInt32

Event ID 34: The strict S4 enforcement _DSM failed evaluation.

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: S4DsmEvaluationFailed

Description

The strict S4 enforcement _DSM failed evaluation. Status Status.

Message #

The strict S4 enforcement _DSM failed evaluation. Status %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 35: MsStateNotification

Provider: Microsoft-Windows-Kernel-Acpi
Channel: Diagnostic
Task: MsStateNotification

Fields #

Name	Description
`Promoted` UInt32
`NextState` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID c514638f-7723-485b-bcfc-96565d735d4a

Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)