Microsoft-Windows-MediaFoundation-MFReadWrite

49 events across 3 channels

Event	Title	Channel	Sample
0	SourceReader_SetCurrentMediaType_Begin	SourceReader	N
1	SourceReader_SetCurrentMediaType_End	SourceReader	N
2	SourceReader_SetCurrentPosition_Begin	SourceReader	N
3	SourceReader_SetCurrentPosition_End	SourceReader	N
4	SourceReader_ReadSample_Begin	SourceReader	N
5	SourceReader_ReadSample_End	SourceReader	N
6	SourceReader_Flush_Begin	SourceReader	N
7	SourceReader_Flush_End	SourceReader	N
8	SourceReader_RequestSample	SourceReader	N
9	SourceReader_MediaSourceEvent	SourceReader	N
10	SourceReader_MediaStreamEvent	SourceReader	N
11	SourceReader_Error	SourceReader	N
12	SourceReader_CapturePluginCreated	SourceReader	N
13	SourceReader_TransformChange	SourceReader	N
14	SourceReader_StreamError	SourceReader	N
15	SourceReader_RequestSample_Begin	SourceReader	N
16	SourceReader_RequestSample_End	SourceReader	N
100	SinkWriter_SetInputMediaType_Begin	SinkWriter	N
101	SinkWriter_SetInputMediaType_End	SinkWriter	N
102	SinkWriter_BeginWriting	SinkWriter	N
103	SinkWriter_WriteSample	SinkWriter	N
104	SinkWriter_StreamTick	SinkWriter	N
105	SinkWriter_Marker_Placed	SinkWriter	N
106	SinkWriter_Marker_Fired	SinkWriter	N
107	SinkWriter_ProcessSample	SinkWriter	N
108	SinkWriter_Finalize_Begin	SinkWriter	N
109	SinkWriter_Finalize_End	SinkWriter	N
110	SinkWriter_MediaSinkEvent	SinkWriter	N
111	SinkWriter_StreamSinkEvent	SinkWriter	N
112	SinkWriter_Throttle_Begin	SinkWriter	N
113	SinkWriter_Throttle_End	SinkWriter	N
114	SinkWriter_Error	SinkWriter	N
115	SinkWriter_StreamError	SinkWriter	N
116	SinkWriter_StateChange	SinkWriter	N
117	SinkWriter_EndOfSegment	SinkWriter	N
118	SinkWriter_Flush	SinkWriter	N
119	SinkWriter_TransformChange	SinkWriter	N
200	Transform_ProcessInput	Transform	N
201	Transform_ProcessInputError	Transform	N
202	Transform_ProcessOutput	Transform	N
203	Transform_ProcessOutputError	Transform	N
204	Transform_ProcessMessage	Transform	N
205	Transform_Event	Transform	N
206	Transform_ProcessEvent	Transform	N
207	Transform_Created	Transform	N
208	Transform_Destroyed	Transform	N
209	MFReadWrite_Transform_Process, only valid in 1-in/1-out mode	Transform	N
210	MFReadWrite_Transform_Process, only valid in 1-in/1-out mode	Transform	N
211	Transform_SetInputType	Transform	N

Event ID 0: SourceReader_SetCurrentMediaType_Begin

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SourceReader
Task: SourceReader_SetCurrentMediaType
Opcode: Start

Description

SourceReader_SetCurrentMediaType_Begin.

Message #

SourceReader_SetCurrentMediaType_Begin

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`MajorType` GUID
`Subtype` GUID

Event ID 1: SourceReader_SetCurrentMediaType_End

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SourceReader
Task: SourceReader_SetCurrentMediaType
Opcode: Stop

Description

SourceReader_SetCurrentMediaType_End.

Message #

SourceReader_SetCurrentMediaType_End

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`ErrorCode` UInt32

Event ID 2: SourceReader_SetCurrentPosition_Begin

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SourceReader
Task: SourceReader_SetCurrentPosition
Opcode: Start

Description

SourceReader_SetCurrentPosition_Begin.

Message #

SourceReader_SetCurrentPosition_Begin

Fields #

Name	Description
`Object` Pointer
`TimeFormat` GUID
`VariantType` UInt32
`Position` UInt64

Event ID 3: SourceReader_SetCurrentPosition_End

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SourceReader
Task: SourceReader_SetCurrentPosition
Opcode: Stop

Description

SourceReader_SetCurrentPosition_End.

Message #

SourceReader_SetCurrentPosition_End

Fields #

Name	Description
`Object` Pointer
`ErrorCode` UInt32

Event ID 4: SourceReader_ReadSample_Begin

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SourceReader
Task: SourceReader_ReadSample
Opcode: Start

Description

SourceReader_ReadSample_Begin.

Message #

SourceReader_ReadSample_Begin

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`ControlFlags` UInt32

Event ID 5: SourceReader_ReadSample_End

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SourceReader
Task: SourceReader_ReadSample
Opcode: Stop

Description

SourceReader_ReadSample_End.

Message #

SourceReader_ReadSample_End

Fields #

Name	Description
`Object` Pointer
`ErrorCode` UInt32
`ActualStreamIndex` UInt32
`StreamFlags` UInt32
`Sample` Pointer
`Timestamp` UInt64
`Duration` UInt64
`Size` UInt32
`Discontinuity` Boolean
`CleanPoint` Boolean

Event ID 6: SourceReader_Flush_Begin

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SourceReader
Task: SourceReader_Flush
Opcode: Start

Description

SourceReader_Flush_Begin.

Message #

SourceReader_Flush_Begin

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32

Event ID 7: SourceReader_Flush_End

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SourceReader
Task: SourceReader_Flush
Opcode: Stop

Description

SourceReader_Flush_End.

Message #

SourceReader_Flush_End

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32

Event ID 8: SourceReader_RequestSample

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SourceReader

Description

SourceReader_RequestSample.

Message #

SourceReader_RequestSample

Event ID 9: SourceReader_MediaSourceEvent

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SourceReader
Task: SourceReader_MediaSourceEvent

Description

SourceReader_MediaSourceEvent.

Message #

SourceReader_MediaSourceEvent

Fields #

Name	Description
`Object` Pointer
`EventType` UInt32
`ErrorCode` UInt32

Event ID 10: SourceReader_MediaStreamEvent

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SourceReader
Task: SourceReader_MediaStreamEvent

Description

SourceReader_MediaStreamEvent.

Message #

SourceReader_MediaStreamEvent

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`EventType` UInt32
`ErrorCode` UInt32

Event ID 11: SourceReader_Error

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SourceReader
Task: SourceReader_Error

Description

SourceReader_Error.

Message #

SourceReader_Error

Fields #

Name	Description
`Object` Pointer
`ErrorCode` UInt32

Event ID 12: SourceReader_CapturePluginCreated

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SourceReader
Task: SourceReader_CapturePluginCreated

Description

SourceReader_CapturePluginCreated.

Message #

SourceReader_CapturePluginCreated

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`MFT` Pointer
`CLSID` GUID
`vtable` Pointer

Event ID 13: SourceReader_TransformChange

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SourceReader
Task: SourceReader_TransformChange

Description

SourceReader_TransformChange.

Message #

SourceReader_TransformChange

Event ID 14: SourceReader_StreamError

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SourceReader
Task: SourceReader_Error

Description

SourceReader_StreamError.

Message #

SourceReader_StreamError

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`ErrorCode` UInt32

Event ID 15: SourceReader_RequestSample_Begin

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SourceReader
Task: SourceReader_RequestSample
Opcode: Start

Description

SourceReader_RequestSample_Begin.

Message #

SourceReader_RequestSample_Begin

Fields #

Name	Description
`Object` Pointer
`RequestCounter` UInt64
`StreamIndex` UInt32

Event ID 16: SourceReader_RequestSample_End

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SourceReader
Task: SourceReader_RequestSample
Opcode: Stop

Description

SourceReader_RequestSample_End.

Message #

SourceReader_RequestSample_End

Fields #

Name	Description
`Object` Pointer
`RequestCounter` UInt64
`StreamIndex` UInt32

Event ID 100: SinkWriter_SetInputMediaType_Begin

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_SetInputMediaType
Opcode: Start

Description

SinkWriter_SetInputMediaType_Begin.

Message #

SinkWriter_SetInputMediaType_Begin

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`MajorType` GUID
`Subtype` GUID

Event ID 101: SinkWriter_SetInputMediaType_End

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_SetInputMediaType
Opcode: Stop

Description

SinkWriter_SetInputMediaType_End.

Message #

SinkWriter_SetInputMediaType_End

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`ErrorCode` UInt32

Event ID 102: SinkWriter_BeginWriting

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_BeginWriting

Description

SinkWriter_BeginWriting.

Message #

SinkWriter_BeginWriting

Fields #

Name	Description
`Object` Pointer

Event ID 103: SinkWriter_WriteSample

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_WriteSample

Description

SinkWriter_WriteSample.

Message #

SinkWriter_WriteSample

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`Sample` Pointer
`Timestamp` UInt64
`Duration` UInt64
`Size` UInt32
`Discontinuity` Boolean
`CleanPoint` Boolean

Event ID 104: SinkWriter_StreamTick

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_StreamTick

Description

SinkWriter_StreamTick.

Message #

SinkWriter_StreamTick

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`Timestamp` UInt64

Event ID 105: SinkWriter_Marker_Placed

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_Marker
Opcode: Start

Description

SinkWriter_Marker_Placed.

Message #

SinkWriter_Marker_Placed

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`Context` Pointer

Event ID 106: SinkWriter_Marker_Fired

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_Marker
Opcode: Stop

Description

SinkWriter_Marker_Fired.

Message #

SinkWriter_Marker_Fired

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`Context` Pointer

Event ID 107: SinkWriter_ProcessSample

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_ProcessSample

Description

SinkWriter_ProcessSample.

Message #

SinkWriter_ProcessSample

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`Sample` Pointer
`Timestamp` UInt64

Event ID 108: SinkWriter_Finalize_Begin

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_Finalize
Opcode: Start

Description

SinkWriter_Finalize_Begin.

Message #

SinkWriter_Finalize_Begin

Fields #

Name	Description
`Object` Pointer

Event ID 109: SinkWriter_Finalize_End

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_Finalize
Opcode: Stop

Description

SinkWriter_Finalize_End.

Message #

SinkWriter_Finalize_End

Fields #

Name	Description
`Object` Pointer
`ErrorCode` UInt32

Event ID 110: SinkWriter_MediaSinkEvent

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_MediaSinkEvent

Description

SinkWriter_MediaSinkEvent.

Message #

SinkWriter_MediaSinkEvent

Fields #

Name	Description
`Object` Pointer
`EventType` UInt32
`ErrorCode` UInt32

Event ID 111: SinkWriter_StreamSinkEvent

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_StreamSinkEvent

Description

SinkWriter_StreamSinkEvent.

Message #

SinkWriter_StreamSinkEvent

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`EventType` UInt32
`ErrorCode` UInt32

Event ID 112: SinkWriter_Throttle_Begin

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_Throttle
Opcode: Start

Description

SinkWriter_Throttle_Begin.

Message #

SinkWriter_Throttle_Begin

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`Threshold` UInt32
`ClockTime` UInt64
`Timestamp` UInt64

Event ID 113: SinkWriter_Throttle_End

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_Throttle
Opcode: Stop

Description

SinkWriter_Throttle_End.

Message #

SinkWriter_Throttle_End

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`Delay` UInt32

Event ID 114: SinkWriter_Error

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_Error

Description

SinkWriter_Error.

Message #

SinkWriter_Error

Fields #

Name	Description
`Object` Pointer
`ErrorCode` UInt32

Event ID 115: SinkWriter_StreamError

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_Error

Description

SinkWriter_StreamError.

Message #

SinkWriter_StreamError

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`ErrorCode` UInt32

Event ID 116: SinkWriter_StateChange

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_StateChange

Description

SinkWriter_StateChange.

Message #

SinkWriter_StateChange

Fields #

Name	Description
`Object` Pointer
`OldState` UInt32
`NewState` UInt32
`ErrorCode` UInt32

Event ID 117: SinkWriter_EndOfSegment

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_EndOfSegment

Description

SinkWriter_EndOfSegment.

Message #

SinkWriter_EndOfSegment

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32

Event ID 118: SinkWriter_Flush

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_Flush

Description

SinkWriter_Flush.

Message #

SinkWriter_Flush

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32

Event ID 119: SinkWriter_TransformChange

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: SinkWriter
Task: SinkWriter_TransformChange

Description

SinkWriter_TransformChange.

Message #

SinkWriter_TransformChange

Event ID 200: Transform_ProcessInput

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: Transform
Task: Transform_ProcessInput

Description

Transform_ProcessInput.

Message #

Transform_ProcessInput

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`Transform` Pointer
`Sample` Pointer
`Timestamp` UInt64
`Duration` UInt64
`Size` UInt32
`Discontinuity` Boolean
`CleanPoint` Boolean
`TransformType` UInt32

Event ID 201: Transform_ProcessInputError

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: Transform
Task: Transform_ProcessInput

Description

Transform_ProcessInputError.

Message #

Transform_ProcessInputError

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`Transform` Pointer
`ErrorCode` UInt32

Event ID 202: Transform_ProcessOutput

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: Transform
Task: Transform_ProcessOutput

Description

Transform_ProcessOutput.

Message #

Transform_ProcessOutput

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`Transform` Pointer
`OutputStreamIndex` UInt32
`Sample` Pointer
`Timestamp` UInt64
`Duration` UInt64
`Size` UInt32
`Discontinuity` Boolean
`CleanPoint` Boolean
`TransformType` UInt32

Event ID 203: Transform_ProcessOutputError

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: Transform
Task: Transform_ProcessOutput

Description

Transform_ProcessOutputError.

Message #

Transform_ProcessOutputError

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`Transform` Pointer
`ErrorCode` UInt32

Event ID 204: Transform_ProcessMessage

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: Transform
Task: Transform_ProcessMessage

Description

Transform_ProcessMessage.

Message #

Transform_ProcessMessage

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`Transform` Pointer
`Message` UInt32
`Param` Pointer

Event ID 205: Transform_Event

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: Transform
Task: Transform_Event

Description

Transform_Event.

Message #

Transform_Event

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`Transform` Pointer
`EventType` UInt32
`ErrorCode` UInt32

Event ID 206: Transform_ProcessEvent

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: Transform
Task: Transform_ProcessEvent

Description

Transform_ProcessEvent.

Message #

Transform_ProcessEvent

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`Transform` Pointer
`EventType` UInt32

Event ID 207: Transform_Created

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: Transform
Task: Transform_Created

Description

Transform_Created.

Message #

Transform_Created

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`MFT` Pointer
`CLSID` GUID
`vtable` Pointer

Event ID 208: Transform_Destroyed

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: Transform
Task: Transform_Destroyed

Description

Transform_Destroyed.

Message #

Transform_Destroyed

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`MFT` Pointer
`CLSID` GUID
`vtable` Pointer

Event ID 209: MFReadWrite_Transform_Process, only valid in 1-in/1-out mode

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: Transform
Task: Transform_Process
Opcode: Start

Description

MFReadWrite_Transform_Process, only valid in 1-in/1-out mode.

Message #

MFReadWrite_Transform_Process, only valid in 1-in/1-out mode

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`Transform` Pointer
`Sample` Pointer
`Timestamp` UInt64
`Duration` UInt64
`Size` UInt32
`Discontinuity` Boolean
`CleanPoint` Boolean
`TransformType` UInt32

Event ID 210: MFReadWrite_Transform_Process, only valid in 1-in/1-out mode

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: Transform
Task: Transform_Process
Opcode: Stop

Description

MFReadWrite_Transform_Process, only valid in 1-in/1-out mode.

Message #

MFReadWrite_Transform_Process, only valid in 1-in/1-out mode

Fields #

Name	Description
`Object` Pointer
`StreamIndex` UInt32
`Transform` Pointer
`OutputStreamIndex` UInt32
`Sample` Pointer
`Timestamp` UInt64
`Duration` UInt64
`Size` UInt32
`Discontinuity` Boolean
`CleanPoint` Boolean
`TransformType` UInt32

Event ID 211: Transform_SetInputType

Provider: Microsoft-Windows-MediaFoundation-MFReadWrite
Channel: Transform
Task: Transform_SetInputType

Description

Transform_SetInputType.

Message #

Transform_SetInputType

Fields #

Name	Description
`Object` Pointer
`TransformType` UInt32
`MediaType` AnsiString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 4b7eac67-fc53-448c-a49d-7cc6db524da7

Defined in MFReadWrite.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)