Microsoft-Windows-RasRoutingProtocols-BGP

52 events across 3 channels

Event	Title	Channel	Sample
1	Event ID 1	Operational	N
1	BGP peering manually started for peer Arg1.	Operational	N
2	Event ID 2	Operational	N
2	BGP peering manually started for peer Arg1 of routing domain Arg2.	Operational	N
3	Event ID 3	Operational	N
3	BGP peering manually stopped for peer Arg1.	Operational	N
4	Event ID 4	Operational	N
4	BGP peering manually stopped for peer Arg1 of routing domain Arg2.	Operational	N
5	Event ID 5	Operational	N
5	BGP peering established for peer Arg1.	Operational	N
6	Event ID 6	Operational	N
6	BGP peering established for peer Arg1 of routing domain Arg2.	Operational	N
7	Event ID 7	Operational	N
7	BGP peering session disconnected for peer Arg1 : Arg2.	Operational	N
8	Event ID 8	Operational	N
8	BGP peering session disconnected for peer Arg1 of routing domain Arg2 : Arg3.	Operational	N
9	Event ID 9	Operational	N
9	BGP peering state changed to Arg1 for peer Arg2.	Debug	N
10	Event ID 10	Operational	N
10	BGP peering state changed to Arg1 for peer Arg2 of routing domain Arg3.	Debug	N
11	Event ID 11	Operational	N
11	Maximum prefix limit reached for peer Arg1.	Operational	N
12	Event ID 12	Operational	N
12	Maximum prefix limit reached for peer Arg1 of routing domain Arg2.	Operational	N
13	Event ID 13	Operational	N
13	BGP peering attempt failed for peer Arg1 : Arg2.	Operational	N
14	Event ID 14	Operational	N
14	BGP peering attempt failed for peer Arg1 of routing domain Arg2 : Arg3.	Operational	N
15	Event ID 15	Operational	N
15	BGP peering collision detected for peer Arg1.	Operational	N
16	Event ID 16	Operational	N
16	BGP peering collision detected for peer Arg1 of routing domain Arg2.	Operational	N
17	Event ID 17	Operational	N
17	HoldTime set to Arg1 sec for peer Arg2.	Operational	N
18	Event ID 18	Operational	N
18	HoldTime set to Arg1 sec for peer Arg2 of routing domain Arg3.	Operational	N
19	Event ID 19	Operational	N
19	TCP connection attempt failed for BGP peer Arg1.	Debug	N
20	Event ID 20	Operational	N
20	TCP connection attempt failed for BGP peer Arg1 of routing domain Arg2.	Debug	N
21	Event ID 21	Operational	N
21	Cannot resolve next-hop Arg1 for destination Arg2, learned from peer Arg3.	Debug	N
22	Event ID 22	Operational	N
22	Cannot resolve next-hop Arg1 for destination Arg2, learned from peer Arg3 of …	Debug	N
23	Event ID 23	Operational	N
23	Routes to Arg1, learned from peer Arg2 were discarded because of ingress routing …	Debug	N
24	Event ID 24	Operational	N
24	Routes to Arg1, learned from peer Arg2 of routing domain Arg3 were discarded …	Debug	N
25	Event ID 25	Operational	N
25	Routes to Arg1, were suppressed from advertisement to peer Arg2 because of …	Debug	N
26	Event ID 26	Operational	N
26	Routes to Arg1, were suppressed from advertisement to peer Arg2 of routing …	Debug	N

Event ID 1

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering manually started for peer .

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 1: BGP peering manually started for peer Arg1.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering manually started for peer Arg1.

Message #

BGP peering manually started for peer %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 2

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering manually started for peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 2: BGP peering manually started for peer Arg1 of routing domain Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering manually started for peer Arg1 of routing domain Arg2.

Message #

BGP peering manually started for peer %1 of routing domain %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 3

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering manually stopped for peer .

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 3: BGP peering manually stopped for peer Arg1.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering manually stopped for peer Arg1.

Message #

BGP peering manually stopped for peer %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 4

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering manually stopped for peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 4: BGP peering manually stopped for peer Arg1 of routing domain Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering manually stopped for peer Arg1 of routing domain Arg2.

Message #

BGP peering manually stopped for peer %1 of routing domain %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 5

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering established for peer .

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 5: BGP peering established for peer Arg1.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering established for peer Arg1.

Message #

BGP peering established for peer %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 6

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering established for peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 6: BGP peering established for peer Arg1 of routing domain Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering established for peer Arg1 of routing domain Arg2.

Message #

BGP peering established for peer %1 of routing domain %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 7

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering session disconnected for peer : .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 7: BGP peering session disconnected for peer Arg1 : Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering session disconnected for peer Arg1 : Arg2.

Message #

BGP peering session disconnected for peer %1 : %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 8

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering session disconnected for peer of routing domain : .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 8: BGP peering session disconnected for peer Arg1 of routing domain Arg2 : Arg3.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering session disconnected for peer Arg1 of routing domain Arg2 : Arg3.

Message #

BGP peering session disconnected for peer %1 of routing domain %2 : %3.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 9

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering state changed to for peer .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 9: BGP peering state changed to Arg1 for peer Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

BGP peering state changed to Arg1 for peer Arg2.

Message #

BGP peering state changed to %1 for peer %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 10

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering state changed to for peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 10: BGP peering state changed to Arg1 for peer Arg2 of routing domain Arg3.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

BGP peering state changed to Arg1 for peer Arg2 of routing domain Arg3.

Message #

BGP peering state changed to %1 for peer %2 of routing domain %3.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 11

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Maximum prefix limit reached for peer .

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 11: Maximum prefix limit reached for peer Arg1.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Maximum prefix limit reached for peer Arg1.

Message #

Maximum prefix limit reached for peer %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 12

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Maximum prefix limit reached for peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 12: Maximum prefix limit reached for peer Arg1 of routing domain Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Maximum prefix limit reached for peer Arg1 of routing domain Arg2.

Message #

Maximum prefix limit reached for peer %1 of routing domain %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 13

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering attempt failed for peer : .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 13: BGP peering attempt failed for peer Arg1 : Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering attempt failed for peer Arg1 : Arg2.

Message #

BGP peering attempt failed for peer %1 : %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 14

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering attempt failed for peer of routing domain : .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 14: BGP peering attempt failed for peer Arg1 of routing domain Arg2 : Arg3.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering attempt failed for peer Arg1 of routing domain Arg2 : Arg3.

Message #

BGP peering attempt failed for peer %1 of routing domain %2 : %3.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 15

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering collision detected for peer .

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 15: BGP peering collision detected for peer Arg1.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering collision detected for peer Arg1.

Message #

BGP peering collision detected for peer %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 16

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering collision detected for peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 16: BGP peering collision detected for peer Arg1 of routing domain Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering collision detected for peer Arg1 of routing domain Arg2.

Message #

BGP peering collision detected for peer %1 of routing domain %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 17

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

HoldTime set to sec for peer .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 17: HoldTime set to Arg1 sec for peer Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

HoldTime set to Arg1 sec for peer Arg2.

Message #

HoldTime set to %1 sec for peer %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 18

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

HoldTime set to sec for peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 18: HoldTime set to Arg1 sec for peer Arg2 of routing domain Arg3.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

HoldTime set to Arg1 sec for peer Arg2 of routing domain Arg3.

Message #

HoldTime set to %1 sec for peer %2 of routing domain %3.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 19

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

TCP connection attempt failed for BGP peer .

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 19: TCP connection attempt failed for BGP peer Arg1.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

TCP connection attempt failed for BGP peer Arg1.

Message #

TCP connection attempt failed for BGP peer %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

TCP connection attempt failed for BGP peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 20: TCP connection attempt failed for BGP peer Arg1 of routing domain Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

TCP connection attempt failed for BGP peer Arg1 of routing domain Arg2.

Message #

TCP connection attempt failed for BGP peer %1 of routing domain %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 21

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Cannot resolve next-hop for destination , learned from peer . Skipping this route for BGP best path selection until the next-hop is resolvable.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 21: Cannot resolve next-hop Arg1 for destination Arg2, learned from peer Arg3.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

Cannot resolve next-hop Arg1 for destination Arg2, learned from peer Arg3. Skipping this route for BGP best path selection until the next-hop is resolvable.

Message #

Cannot resolve next-hop %1 for destination %2, learned from peer %3. Skipping this route for BGP best path selection until the next-hop is resolvable.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 22

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Cannot resolve next-hop for destination , learned from peer of routing domain . Skipping this route for BGP best path selection until the next-hop is resolvable.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString
`Arg4` UnicodeString

Event ID 22: Cannot resolve next-hop Arg1 for destination Arg2, learned from peer Arg3 of routing domain Arg4.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

Cannot resolve next-hop Arg1 for destination Arg2, learned from peer Arg3 of routing domain Arg4. Skipping this route for BGP best path selection until the next-hop is resolvable.

Message #

Cannot resolve next-hop %1 for destination %2, learned from peer %3 of routing domain %4. Skipping this route for BGP best path selection until the next-hop is resolvable.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString
`Arg4` UnicodeString

Event ID 23

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Routes to , learned from peer were discarded because of ingress routing policy.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 23: Routes to Arg1, learned from peer Arg2 were discarded because of ingress routing policy.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

Routes to Arg1, learned from peer Arg2 were discarded because of ingress routing policy.

Message #

Routes to %1, learned from peer %2 were discarded because of ingress routing policy.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 24

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Routes to , learned from peer of routing domain were discarded because of ingress routing policy.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 24: Routes to Arg1, learned from peer Arg2 of routing domain Arg3 were discarded because of ingress routing policy.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

Routes to Arg1, learned from peer Arg2 of routing domain Arg3 were discarded because of ingress routing policy.

Message #

Routes to %1, learned from peer %2 of routing domain %3 were discarded because of ingress routing policy.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 25

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Routes to , were suppressed from advertisement to peer because of egress routing policy.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 25: Routes to Arg1, were suppressed from advertisement to peer Arg2 because of egress routing policy.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

Routes to Arg1, were suppressed from advertisement to peer Arg2 because of egress routing policy.

Message #

Routes to %1, were suppressed from advertisement to peer %2 because of egress routing policy.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 26

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Routes to , were suppressed from advertisement to peer of routing domain because of egress routing policy.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 26: Routes to Arg1, were suppressed from advertisement to peer Arg2 of routing domain Arg3 because of egress routing policy.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

Routes to Arg1, were suppressed from advertisement to peer Arg2 of routing domain Arg3 because of egress routing policy.

Message #

Routes to %1, were suppressed from advertisement to peer %2 of routing domain %3 because of egress routing policy.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 2e67fcf3-c48e-4b2d-a689-a91d07edb910

Defined in BgpRasMgmt.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02

Downloads

Microsoft-Windows-RasRoutingProtocols-BGP registered manifest XML (in the WS2022-20348.4893 manifest pack, 1.9 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)