Microsoft-Windows-NdisImPlatformEventProvider

48 events across 1 channel

Event	Title	Channel	Sample
1	Received NetPnPEvent NetPnpEvent from Member Member.	Operational	N
2	Nic Adapter is transitioning into a new power state PowerState.	Operational	N
3	Member Adapter is doing a status indication.	Operational	N
4	Member Adapter is indicating a new link state.	Operational	N
5	Oid Oid on TeamNic Adapter failed due to invalid port number.	Operational	N
6	Forwarding of OID Oid from TeamNic TeamNic due to Member Member failed.	Operational	N
7	Querying for OID Oid on TeamNic Adapter failed.	Operational	N
8	Failed to set OID_GEN_CURRENT_LOOKAHEAD on Member Adapter.	Operational	N
9	Failed to set OID_GEN_CURRENT_LOOKAHEAD on TeamNic Adapter.	Operational	N
10	New Packet Filters for TeamNic TeamNic are PacketFilter.	Operational	N
11	Received new per-port Packet Filters PacketFilter for TeamNic TeamNic and Member …	Operational	N
12	Failed to set OID_GEN_CURRENT_PACKET_FILTER on Member Adapter.	Operational	N
13	Failed OID_802_3_MULTICAST_LIST on Member Member while processing the Oid on …	Operational	N
14	Failed OID_OFFLOAD_ENCAPSULATION on Member Member while processing the Oid on …	Operational	N
15	Failed to set OID Oid on TeamNic Adapter.	Operational	N
16	Recalculating Packet Filters on Member Adapter failed.	Operational	N
17	Failed Sending as TeamNic Adapter is not available.	Operational	N
18	Failed Sending as Member is not found	Operational	N
19	Aborted Sending on TeamNic Adapter.	Operational	N
20	Member Adapter is not ready to receive.	Operational	N
21	Aborting receive on TeamNic Adapter as it is not ready.	Operational	N
22	No matching TeamNic found for packets received from member Adapter.	Operational	N
23	Aborting sending queued NBLs on TeamNic TeamNic and Member Member.	Operational	N
24	Binding to member adapter Adapter.	Operational	N
25	Unbinding from member adapter Adapter.	Operational	N
26	Binding to member adapter Adapter failed.	Operational	N
27	Creating internal binding between TeamNic TeamNic and Member Member.	Operational	N
28	Creating internal binding between TeamNic TeamNic and Member Member failed.	Operational	N
29	Removed internal binding between TeamNic TeamNic and Member Member.	Operational	N
30	Allocating Port failed for Member TeamNic on TeamNic Member, Status = Status.	Operational	N
31	Creating team Team.	Operational	N
32	Creating team Team failed, Status = Status.	Operational	N
33	Removed team Team.	Operational	N
34	Added Member Member to team Team.	Operational	N
35	Added Member Member from team Team.	Operational	N
36	Added TeamNic TeamNic to team Team.	Operational	N
37	Removed TeamNic TeamNic from team Team.	Operational	N
38	Creating TeamNic TeamNic for Team Team.	Operational	N
39	Creating TeamNic TeamNic for Team Team failed, Status = Status.	Operational	N
40	Removed TeamNic Adapter.	Operational	N
41	Indicated new task offload hardware capabilities for TeamNic TeamNic.	Operational	N
42	Indicated new task offload current config for TeamNic TeamNic.	Operational	N
43	TeamNic Adapter indicated link state change.	Operational	N
44	Support MacOptions for TeamNic TeamNic reduced from OldValue to NewValue due to …	Operational	N
45	Support MtuSize for TeamNic TeamNic reduced from OldValue to NewValue due to …	Operational	N
46	TeamNic Adapter being initialized.	Operational	N
47	TeamNic Adapter failed to Initialize, Status = Status.	Operational	N
48	TeamNic Adapter halted.	Operational	N

Event ID 1: Received NetPnPEvent NetPnpEvent from Member Member.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Received NetPnPEvent NetPnpEvent from Member Member.

Message #

Received NetPnPEvent %1 from Member %2

Fields #

Name	Description
`NetPnpEvent` UInt32
`Member` UnicodeString

Event ID 2: Nic Adapter is transitioning into a new power state PowerState.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Nic Adapter is transitioning into a new power state PowerState.

Message #

Nic %1 is transitioning into a new power state %2

Fields #

Name	Description
`Adapter` UnicodeString
`PowerState` UInt32

Event ID 3: Member Adapter is doing a status indication.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Member Adapter is doing a status indication. StatusCode = StatusBufferLength.

Message #

Member %1 is doing a status indication. StatusCode = %2

Fields #

Name	Description
`Adapter` UnicodeString
`StatusBufferLength` UInt32
`StatusBuffer` Binary

Event ID 4: Member Adapter is indicating a new link state.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Member Adapter is indicating a new link state. Link State Buffer = StatusBuffer.

Message #

Member %1 is indicating a new link state. Link State Buffer = %3

Fields #

Name	Description
`Adapter` UnicodeString
`StatusBufferLength` UInt32
`StatusBuffer` Binary

Event ID 5: Oid Oid on TeamNic Adapter failed due to invalid port number.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Oid Oid on TeamNic Adapter failed due to invalid port number. Oid Buffer = OidBuffer.

Message #

Oid %1 on TeamNic %2 failed due to invalid port number. Oid Buffer = %4

Fields #

Name	Description
`Oid` UInt32
`Adapter` UnicodeString
`OidBufferLen` UInt32
`OidBuffer` Binary
`Status` Int32	NTSTATUS reference

Event ID 6: Forwarding of OID Oid from TeamNic TeamNic due to Member Member failed.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Forwarding of OID Oid from TeamNic TeamNic due to Member Member failed. Status = Status.

Message #

Forwarding of OID %1 from TeamNic %2 due to Member %3 failed.  Status = %4

Fields #

Name	Description
`Oid` UInt32
`TeamNic` UnicodeString
`Member` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 7: Querying for OID Oid on TeamNic Adapter failed.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Querying for OID Oid on TeamNic Adapter failed. OidBuffer is OidBuffer failed. Status = Status.

Message #

Querying for OID %1 on TeamNic %2 failed. OidBuffer is %4 failed.  Status = %5

Fields #

Name	Description
`Oid` UInt32
`Adapter` UnicodeString
`OidBufferLen` UInt32
`OidBuffer` Binary
`Status` Int32	NTSTATUS reference

Event ID 8: Failed to set OID_GEN_CURRENT_LOOKAHEAD on Member Adapter.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Failed to set OID_GEN_CURRENT_LOOKAHEAD on Member Adapter. Status = Status.

Message #

Failed to set OID_GEN_CURRENT_LOOKAHEAD on Member %1. Status = %2

Fields #

Name	Description
`Adapter` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 9: Failed to set OID_GEN_CURRENT_LOOKAHEAD on TeamNic Adapter.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Failed to set OID_GEN_CURRENT_LOOKAHEAD on TeamNic Adapter. Status = Status.

Message #

Failed to set OID_GEN_CURRENT_LOOKAHEAD on TeamNic %1. Status = %2

Fields #

Name	Description
`Adapter` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 10: New Packet Filters for TeamNic TeamNic are PacketFilter.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

New Packet Filters for TeamNic TeamNic are PacketFilter.

Message #

New Packet Filters for TeamNic %1 are %2

Fields #

Name	Description
`TeamNic` UnicodeString
`PacketFilter` UInt32

Event ID 11: Received new per-port Packet Filters PacketFilter for TeamNic TeamNic and Member Member.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Received new per-port Packet Filters PacketFilter for TeamNic TeamNic and Member Member.

Message #

Received new per-port Packet Filters %3 for TeamNic %1 and Member %2

Fields #

Name	Description
`TeamNic` UnicodeString
`Member` UnicodeString
`PacketFilter` UInt32

Event ID 12: Failed to set OID_GEN_CURRENT_PACKET_FILTER on Member Adapter.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Failed to set OID_GEN_CURRENT_PACKET_FILTER on Member Adapter. Status = Status.

Message #

Failed to set OID_GEN_CURRENT_PACKET_FILTER on Member %1.  Status = %2

Fields #

Name	Description
`Adapter` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 13: Failed OID_802_3_MULTICAST_LIST on Member Member while processing the Oid on TeamNic TeamNic.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Failed OID_802_3_MULTICAST_LIST on Member Member while processing the Oid on TeamNic TeamNic. Status = Status.

Message #

Failed OID_802_3_MULTICAST_LIST on Member %1 while processing the Oid on TeamNic %2. Status = %3

Fields #

Name	Description
`Member` UnicodeString
`TeamNic` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 14: Failed OID_OFFLOAD_ENCAPSULATION on Member Member while processing the Oid on TeamNic TeamNic.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Failed OID_OFFLOAD_ENCAPSULATION on Member Member while processing the Oid on TeamNic TeamNic. Status = Status.

Message #

Failed OID_OFFLOAD_ENCAPSULATION on Member %1 while processing the Oid on TeamNic %2. Status = %3

Fields #

Name	Description
`Member` UnicodeString
`TeamNic` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 15: Failed to set OID Oid on TeamNic Adapter.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Failed to set OID Oid on TeamNic Adapter. Buffer is OidBuffer . Status = Status.

Message #

Failed to set OID %1 on TeamNic %2. Buffer is %4 . Status = %5

Fields #

Name	Description
`Oid` UInt32
`Adapter` UnicodeString
`OidBufferLen` UInt32
`OidBuffer` Binary
`Status` Int32	NTSTATUS reference

Event ID 16: Recalculating Packet Filters on Member Adapter failed.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Recalculating Packet Filters on Member Adapter failed. Status = Status.

Message #

Recalculating Packet Filters on Member %1 failed. Status = %2

Fields #

Name	Description
`Adapter` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 17: Failed Sending as TeamNic Adapter is not available.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Failed Sending as TeamNic Adapter is not available.

Message #

Failed Sending as TeamNic %1 is not available

Fields #

Name	Description
`Adapter` UnicodeString

Event ID 18: Failed Sending as Member is not found

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Failed Sending as Member is not found.

Message #

Failed Sending as Member is not found

Event ID 19: Aborted Sending on TeamNic Adapter.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Aborted Sending on TeamNic Adapter.

Message #

Aborted Sending on TeamNic %1

Fields #

Name	Description
`Adapter` UnicodeString

Event ID 20: Member Adapter is not ready to receive.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Member Adapter is not ready to receive.

Message #

Member %1 is not ready to receive.

Fields #

Name	Description
`Adapter` UnicodeString

Event ID 21: Aborting receive on TeamNic Adapter as it is not ready.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Aborting receive on TeamNic Adapter as it is not ready.

Message #

Aborting receive on TeamNic %1 as it is not ready.

Fields #

Name	Description
`Adapter` UnicodeString

Event ID 22: No matching TeamNic found for packets received from member Adapter.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

No matching TeamNic found for packets received from member Adapter.

Message #

No matching TeamNic found for packets received from member %1.

Fields #

Name	Description
`Adapter` UnicodeString

Event ID 23: Aborting sending queued NBLs on TeamNic TeamNic and Member Member.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Aborting sending queued NBLs on TeamNic TeamNic and Member Member.

Message #

Aborting sending queued NBLs on TeamNic %1 and Member %2.

Fields #

Name	Description
`TeamNic` UnicodeString
`Member` UnicodeString

Event ID 24: Binding to member adapter Adapter.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Binding to member adapter Adapter.

Message #

Binding to member adapter %1.

Fields #

Name	Description
`Adapter` UnicodeString

Event ID 25: Unbinding from member adapter Adapter.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Unbinding from member adapter Adapter.

Message #

Unbinding from member adapter %1.

Fields #

Name	Description
`Adapter` UnicodeString

Event ID 26: Binding to member adapter Adapter failed.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Binding to member adapter Adapter failed. Status = Status. Potential reason could be inadequate capabilities.

Message #

Binding to member adapter %1 failed. Status = %2. Potential reason could be inadequate capabilities.

Fields #

Name	Description
`Adapter` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 27: Creating internal binding between TeamNic TeamNic and Member Member.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Creating internal binding between TeamNic TeamNic and Member Member.

Message #

Creating internal binding between TeamNic %1 and Member %2.

Fields #

Name	Description
`TeamNic` UnicodeString
`Member` UnicodeString

Event ID 28: Creating internal binding between TeamNic TeamNic and Member Member failed.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Creating internal binding between TeamNic TeamNic and Member Member failed. Status = Status.

Message #

Creating internal binding between TeamNic %1 and Member %2 failed. Status = %3

Fields #

Name	Description
`TeamNic` UnicodeString
`Member` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 29: Removed internal binding between TeamNic TeamNic and Member Member.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Removed internal binding between TeamNic TeamNic and Member Member.

Message #

Removed internal binding between TeamNic %1 and Member %2.

Fields #

Name	Description
`TeamNic` UnicodeString
`Member` UnicodeString

Event ID 30: Allocating Port failed for Member TeamNic on TeamNic Member, Status = Status.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Allocating Port failed for Member TeamNic on TeamNic Member, Status = Status.

Message #

Allocating Port failed for Member %1 on TeamNic %2, Status = %3.

Fields #

Name	Description
`TeamNic` UnicodeString
`Member` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 31: Creating team Team.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Creating team Team.

Message #

Creating team %1.

Fields #

Name	Description
`Team` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 32: Creating team Team failed, Status = Status.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Creating team Team failed, Status = Status.

Message #

Creating team %1 failed, Status = %2.

Fields #

Name	Description
`Team` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 33: Removed team Team.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Removed team Team.

Message #

Removed team %1.

Fields #

Name	Description
`Team` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 34: Added Member Member to team Team.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Added Member Member to team Team.

Message #

Added Member %2 to team %1.

Fields #

Name	Description
`Team` UnicodeString
`Member` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 35: Added Member Member from team Team.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Added Member Member from team Team.

Message #

Added Member %2 from team %1.

Fields #

Name	Description
`Team` UnicodeString
`Member` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 36: Added TeamNic TeamNic to team Team.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Added TeamNic TeamNic to team Team.

Message #

Added TeamNic %2 to team %1.

Fields #

Name	Description
`Team` UnicodeString
`TeamNic` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 37: Removed TeamNic TeamNic from team Team.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Removed TeamNic TeamNic from team Team.

Message #

Removed TeamNic %2 from team %1.

Fields #

Name	Description
`Team` UnicodeString
`TeamNic` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 38: Creating TeamNic TeamNic for Team Team.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Creating TeamNic TeamNic for Team Team.

Message #

Creating TeamNic %2 for Team %1.

Fields #

Name	Description
`Team` UnicodeString
`TeamNic` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 39: Creating TeamNic TeamNic for Team Team failed, Status = Status.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Creating TeamNic TeamNic for Team Team failed, Status = Status.

Message #

Creating TeamNic %2 for Team %1 failed, Status = %3.

Fields #

Name	Description
`Team` UnicodeString
`TeamNic` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 40: Removed TeamNic Adapter.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Removed TeamNic Adapter.

Message #

Removed TeamNic %1.

Fields #

Name	Description
`Adapter` UnicodeString

Event ID 41: Indicated new task offload hardware capabilities for TeamNic TeamNic.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Indicated new task offload hardware capabilities for TeamNic TeamNic. StatusBuffer = Buffer.

Message #

Indicated new task offload hardware capabilities for TeamNic %1. StatusBuffer = %3.

Fields #

Name	Description
`TeamNic` UnicodeString
`BufferLen` UInt32
`Buffer` Binary

Event ID 42: Indicated new task offload current config for TeamNic TeamNic.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Indicated new task offload current config for TeamNic TeamNic. StatusBuffer = Buffer.

Message #

Indicated new task offload current config for TeamNic %1. StatusBuffer = %3.

Fields #

Name	Description
`TeamNic` UnicodeString
`BufferLen` UInt32
`Buffer` Binary

Event ID 43: TeamNic Adapter indicated link state change.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

TeamNic Adapter indicated link state change. StatusBuffer = StatusBuffer.

Message #

TeamNic %1 indicated link state change. StatusBuffer = %3.

Fields #

Name	Description
`Adapter` UnicodeString
`StatusBufferLength` UInt32
`StatusBuffer` Binary

Event ID 44: Support MacOptions for TeamNic TeamNic reduced from OldValue to NewValue due to cached capabilities of a member which is currently not bound to the team.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Support MacOptions for TeamNic TeamNic reduced from OldValue to NewValue due to cached capabilities of a member which is currently not bound to the team.

Message #

Support MacOptions for TeamNic %1 reduced from %2 to %3 due to cached capabilities of a member which is currently not bound to the team

Fields #

Name	Description
`TeamNic` UnicodeString
`OldValue` UInt32
`NewValue` UInt32

Event ID 45: Support MtuSize for TeamNic TeamNic reduced from OldValue to NewValue due to cached capabilities of a member which is currently not bound to the team.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

Support MtuSize for TeamNic TeamNic reduced from OldValue to NewValue due to cached capabilities of a member which is currently not bound to the team.

Message #

Support MtuSize for TeamNic %1 reduced from %2 to %3 due to cached capabilities of a member which is currently not bound to the team

Fields #

Name	Description
`TeamNic` UnicodeString
`OldValue` UInt32
`NewValue` UInt32

Event ID 46: TeamNic Adapter being initialized.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

TeamNic Adapter being initialized.

Message #

TeamNic %1 being initialized.

Fields #

Name	Description
`Adapter` UnicodeString

Event ID 47: TeamNic Adapter failed to Initialize, Status = Status.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

TeamNic Adapter failed to Initialize, Status = Status.

Message #

TeamNic %1 failed to Initialize, Status = %2.

Fields #

Name	Description
`Adapter` UnicodeString
`Status` Int32	NTSTATUS reference

Event ID 48: TeamNic Adapter halted.

Provider: Microsoft-Windows-NdisImPlatformEventProvider
Channel: Operational

Description

TeamNic Adapter halted.

Message #

TeamNic %1 halted.

Fields #

Name	Description
`Adapter` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 11c5d8ad-756a-42c2-8087-eb1b4a72a846

Defined in NdisImPlatform.sys, the binary that emits these events.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)