Microsoft-Windows-SettingSync-OneDrive

48 events across 3 channels

Event	Title	Channel	Sample
1000	Event ID 1000	Operational	N
1001	Event ID 1001	Operational	N
1002	Event ID 1002	Operational	N
1003	Cannot find restore folder for collection {CollectionId}.	Operational	N
1004	Reupload Needed request for {CollectionId}.	Operational	N
1005	Shared settings in the collection {CollectionId} didnt sync.	Operational	N
1006	Cloud sync provider encountered an unexpected null setting unit in collection …	Operational	N
1007	Cloud provider failed to update setting unit {SettingUnitId} in collection …	Operational	N
1008	MSA ticket request failed for current user.	Operational	N
1012	The sync server returned error {Value}.	Operational	N
1013	Settings view failed to parse.	Operational	N
1014	UserTile view failed to parse.	Operational	N
1015	Failed to parse response from Live Storage Quota API.	Operational	N
1016	Activation of PDC failed.	Operational	N
1017	Policy document failed to parse.	Operational	N
1018	Policy document failed to download.	Operational	N
1019	Policy document failed to save.	Operational	N
1020	Notification WNS channel {ChannelName} creation failed (Result: {HRESULT}).	Operational	N
1021	Notification WLS channel {ChannelName} creation failed (Result: {HRESULT}).	Operational	N
3000	Event ID 3000	Debug	N
3001	Event ID 3001	Debug	N
3002	Event ID 3002	Debug	N
3003	Setting unit {SettingUnitId} failed to upload with WriteStatus ({WriteStatus}).	Debug	N
3004	A garbage collection occurred in cloud storage.	Debug	N
3005	Device was still interested in garbge collected collection {CollectionId}.	Debug	N
3006	Collection {CollectionId} was removed completely from the device due to a …	Debug	N
3008	Collection {CollectionId} failed to back up (Result: {HRESULT}).	Debug	N
3009	Property {PropStoreName} of the setting unit {SettingUnitId} was not applied as …	Debug	N
3010	The {ProviderName} provider cleaned up tombstones for {CollectionId} (HRESULT: …	Debug	N
3011	Setting unit {SettingUnitId} in collection {CollectionId} was backed up via BITS …	Debug	N
3012	Cloud provider updated setting unit {SettingUnitId} in collection {CollectionId} …	Debug	N
3013	A missing blob for setting unit {SettingUnitId} in collection {CollectionId} was …	Debug	N
3014	A missing blob for setting unit {SettingUnitId} in collection {CollectionId} was …	Debug	N
3015	Ramp State Update: {Name} upgraded from {OldValue} to {NewValue}.	Debug	N
3017	BITS Upload session failed for setting unit {SettingUnitId} for collection …	Debug	N
3018	Register Notification Response: {Response}.	Debug	N
3020	Storage request: {Verb} to {Url} completed with status code {StatusCode}.	Debug	N
3021	Uploading Batch to service with transaction Id: {TransactionId}.	Debug	N
3022	Collection Metadata Destroy Failure.	Debug	N
3023	PDCActivation was used by process {Message} instead of SettingSyncHost.	Debug	N
3024	Collection {CollectionId} was blocked from uploading to cloud storage.	Debug	N
3025	Collection {CollectionId} was blocked from downloading to Windows.	Debug	N
3026	Storage subscription operation (create/update) failed for {CollectionId} …	Debug	N
3027	Storage subscription operation (delete) failed for {CollectionId} (HRESULT: …	Debug	N
3029	The collection ({CollectionId}) is being throttled due to excessive syncing.	Debug	N
9000	Event ID 9000	Analytic	N
9001	Event ID 9001	Analytic	N
9002	Event ID 9002	Analytic	N

Event ID 1000

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 1001

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 1002

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 1003: Cannot find restore folder for collection {CollectionId}.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Description

Cannot find restore folder for collection {CollectionId}. Looks like it was stolen by another device and then deleted.

Message #

Cannot find restore folder for collection {CollectionId}. Looks like it was stolen by another device and then deleted.

Fields #

Name	Description
`CollectionId`

Event ID 1004: Reupload Needed request for {CollectionId}.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Description

Reupload Needed request for {CollectionId}. (Result: {HRESULT}).

Message #

Reupload Needed request for {CollectionId}. (Result: {HRESULT})

Fields #

Name	Description
`CollectionId`
`HRESULT`

Event ID 1005: Shared settings in the collection {CollectionId} didnt sync.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Message #

Shared settings in the collection {CollectionId} didnt sync. The updates were blocked by the server because theyre too big or have changed too frequently. The settings will sync again when the limits have been reset.

Fields #

Name	Description
`CollectionId`

Event ID 1006: Cloud sync provider encountered an unexpected null setting unit in collection {CollectionId} (saveAction: {Value}; Result: {HRESULT}).

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Description

Cloud sync provider encountered an unexpected null setting unit in collection {CollectionId} (saveAction: {Value}; Result: {HRESULT}).

Message #

Cloud sync provider encountered an unexpected null setting unit in collection {CollectionId} (saveAction: {Value}; Result: {HRESULT})

Fields #

Name	Description
`CollectionId`
`Value`
`HRESULT`

Event ID 1007: Cloud provider failed to update setting unit {SettingUnitId} in collection {CollectionId} (Operation: {Operation}; Result: {HRESULT}).

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Description

Cloud provider failed to update setting unit {SettingUnitId} in collection {CollectionId} (Operation: {Operation}; Result: {HRESULT}).

Message #

Cloud provider failed to update setting unit {SettingUnitId} in collection {CollectionId} (Operation: {Operation}; Result: {HRESULT})

Fields #

Name	Description
`SettingUnitId`
`CollectionId`
`Operation`	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`HRESULT`

Event ID 1008: MSA ticket request failed for current user.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Description

MSA ticket request failed for current user. (Result: {HRESULT}).

Message #

MSA ticket request failed for current user. (Result: {HRESULT})

Fields #

Name	Description
`HRESULT`

Event ID 1012: The sync server returned error {Value}.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Description

The sync server returned error {Value}. Shared settings might be out of sync.

Message #

The sync server returned error {Value}. Shared settings might be out of sync.

Fields #

Name	Description
`Value`

Event ID 1013: Settings view failed to parse.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Description

Settings view failed to parse. (Result: {HRESULT}).

Message #

Settings view failed to parse. (Result: {HRESULT})

Fields #

Name	Description
`HRESULT`

Event ID 1014: UserTile view failed to parse.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Description

UserTile view failed to parse. (Result: {HRESULT}).

Message #

UserTile view failed to parse. (Result: {HRESULT})

Fields #

Name	Description
`HRESULT`

Event ID 1015: Failed to parse response from Live Storage Quota API.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Description

Failed to parse response from Live Storage Quota API. (Result: {HRESULT}).

Message #

Failed to parse response from Live Storage Quota API. (Result: {HRESULT})

Fields #

Name	Description
`HRESULT`

Event ID 1016: Activation of PDC failed.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Description

Activation of PDC failed. (Result: {HRESULT}).

Message #

Activation of PDC failed. (Result: {HRESULT})

Fields #

Name	Description
`HRESULT`

Event ID 1017: Policy document failed to parse.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Description

Policy document failed to parse. (Result: {HRESULT}).

Message #

Policy document failed to parse. (Result: {HRESULT})

Fields #

Name	Description
`HRESULT`

Event ID 1018: Policy document failed to download.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Description

Policy document failed to download. (Result: {HRESULT}).

Message #

Policy document failed to download. (Result: {HRESULT})

Fields #

Name	Description
`HRESULT`

Event ID 1019: Policy document failed to save.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Description

Policy document failed to save. (Result: {HRESULT}).

Message #

Policy document failed to save. (Result: {HRESULT})

Fields #

Name	Description
`HRESULT`

Event ID 1020: Notification WNS channel {ChannelName} creation failed (Result: {HRESULT}).

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Description

Notification WNS channel {ChannelName} creation failed (Result: {HRESULT}).

Message #

Notification WNS channel {ChannelName} creation failed (Result: {HRESULT})

Fields #

Name	Description
`ChannelName`
`HRESULT`

Event ID 1021: Notification WLS channel {ChannelName} creation failed (Result: {HRESULT}).

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Operational

Description

Notification WLS channel {ChannelName} creation failed (Result: {HRESULT}).

Message #

Notification WLS channel {ChannelName} creation failed (Result: {HRESULT})

Fields #

Name	Description
`ChannelName`
`HRESULT`

Event ID 3000

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 3001

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 3002

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 3003: Setting unit {SettingUnitId} failed to upload with WriteStatus ({WriteStatus}).

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

Setting unit {SettingUnitId} failed to upload with WriteStatus ({WriteStatus}).

Message #

Setting unit {SettingUnitId} failed to upload with WriteStatus ({WriteStatus})

Fields #

Name	Description
`SettingUnitId`
`WriteStatus`

Event ID 3004: A garbage collection occurred in cloud storage.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

A garbage collection occurred in cloud storage. {Value} collection(s) on this device were removed.

Message #

A garbage collection occurred in cloud storage. {Value} collection(s) on this device were removed.

Fields #

Name	Description
`Value`

Event ID 3005: Device was still interested in garbge collected collection {CollectionId}.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

Device was still interested in garbge collected collection {CollectionId}.

Message #

Device was still interested in garbge collected collection {CollectionId}.

Fields #

Name	Description
`CollectionId`

Event ID 3006: Collection {CollectionId} was removed completely from the device due to a garbage collection in cloud storage.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

Collection {CollectionId} was removed completely from the device due to a garbage collection in cloud storage.

Message #

Collection {CollectionId} was removed completely from the device due to a garbage collection in cloud storage.

Fields #

Name	Description
`CollectionId`

Event ID 3008: Collection {CollectionId} failed to back up (Result: {HRESULT}).

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

Collection {CollectionId} failed to back up (Result: {HRESULT}).

Message #

Collection {CollectionId} failed to back up (Result: {HRESULT})

Fields #

Name	Description
`CollectionId`
`HRESULT`

Event ID 3009: Property {PropStoreName} of the setting unit {SettingUnitId} was not applied as more recent settings were detected locally.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

Property {PropStoreName} of the setting unit {SettingUnitId} was not applied as more recent settings were detected locally.

Message #

Property {PropStoreName} of the setting unit {SettingUnitId} was not applied as more recent settings were detected locally.

Fields #

Name	Description
`PropStoreName`
`SettingUnitId`

Event ID 3010: The {ProviderName} provider cleaned up tombstones for {CollectionId} (HRESULT: {HRESULT}).

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

The {ProviderName} provider cleaned up tombstones for {CollectionId} (HRESULT: {HRESULT}).

Message #

The {ProviderName} provider cleaned up tombstones for {CollectionId} (HRESULT: {HRESULT})

Fields #

Name	Description
`ProviderName`
`CollectionId`
`HRESULT`

Event ID 3011: Setting unit {SettingUnitId} in collection {CollectionId} was backed up via BITS (Result: {HRESULT}).

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

Setting unit {SettingUnitId} in collection {CollectionId} was backed up via BITS (Result: {HRESULT}).

Message #

Setting unit {SettingUnitId} in collection {CollectionId} was backed up via BITS (Result: {HRESULT})

Fields #

Name	Description
`SettingUnitId`
`CollectionId`
`HRESULT`

Event ID 3012: Cloud provider updated setting unit {SettingUnitId} in collection {CollectionId} (Operation: {Operation}).

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

Cloud provider updated setting unit {SettingUnitId} in collection {CollectionId} (Operation: {Operation}).

Message #

Cloud provider updated setting unit {SettingUnitId} in collection {CollectionId} (Operation: {Operation})

Fields #

Name	Description
`SettingUnitId`
`CollectionId`
`Operation`	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 3013: A missing blob for setting unit {SettingUnitId} in collection {CollectionId} was detected in cloud storage.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

A missing blob for setting unit {SettingUnitId} in collection {CollectionId} was detected in cloud storage. Attempting repair.

Message #

A missing blob for setting unit {SettingUnitId} in collection {CollectionId} was detected in cloud storage. Attempting repair.

Fields #

Name	Description
`SettingUnitId`
`CollectionId`

Event ID 3014: A missing blob for setting unit {SettingUnitId} in collection {CollectionId} was detected in cloud storage; but this client cannot repair it.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

A missing blob for setting unit {SettingUnitId} in collection {CollectionId} was detected in cloud storage; but this client cannot repair it.

Message #

A missing blob for setting unit {SettingUnitId} in collection {CollectionId} was detected in cloud storage; but this client cannot repair it

Fields #

Name	Description
`SettingUnitId`
`CollectionId`

Event ID 3015: Ramp State Update: {Name} upgraded from {OldValue} to {NewValue}.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

Ramp State Update: {Name} upgraded from {OldValue} to {NewValue}.

Message #

Ramp State Update: {Name} upgraded from {OldValue} to {NewValue}

Fields #

Name	Description
`Name`
`OldValue`
`NewValue`

Event ID 3017: BITS Upload session failed for setting unit {SettingUnitId} for collection {CollectionId} (HRESULT: {Operation}).

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

BITS Upload session failed for setting unit {SettingUnitId} for collection {CollectionId} (HRESULT: {Operation}).

Message #

BITS Upload session failed for setting unit {SettingUnitId} for collection {CollectionId} (HRESULT: {Operation})

Fields #

Name	Description
`SettingUnitId`
`CollectionId`
`Operation`	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 3018: Register Notification Response: {Response}.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

Message #

Register Notification Response: {Response}

Fields #

Name	Description
`Response`

Event ID 3020: Storage request: {Verb} to {Url} completed with status code {StatusCode}.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

Storage request: {Verb} to {Url} completed with status code {StatusCode}.

Message #

Storage request: {Verb} to {Url} completed with status code {StatusCode}.

Fields #

Name	Description
`Verb`
`Url`
`StatusCode`	NTSTATUS reference

Event ID 3021: Uploading Batch to service with transaction Id: {TransactionId}.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

Uploading Batch to service with transaction Id: {TransactionId}.

Message #

Uploading Batch to service with transaction Id: {TransactionId}

Fields #

Name	Description
`TransactionId`

Event ID 3022: Collection Metadata Destroy Failure.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

Collection Metadata Destroy Failure. Collection Id: {Message}. HRESULT: {HRESULT}.

Message #

Collection Metadata Destroy Failure. Collection Id: {Message}. HRESULT: {HRESULT}.

Fields #

Name	Description
`Message`
`HRESULT`

Event ID 3023: PDCActivation was used by process {Message} instead of SettingSyncHost.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

PDCActivation was used by process {Message} instead of SettingSyncHost.

Message #

PDCActivation was used by process {Message} instead of SettingSyncHost

Fields #

Name	Description
`Message`

Event ID 3024: Collection {CollectionId} was blocked from uploading to cloud storage.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

Collection {CollectionId} was blocked from uploading to cloud storage. (Reason: {Reason}).

Message #

Collection {CollectionId} was blocked from uploading to cloud storage. (Reason: {Reason})

Fields #

Name	Description
`CollectionId`
`Reason`

Event ID 3025: Collection {CollectionId} was blocked from downloading to Windows.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

Collection {CollectionId} was blocked from downloading to Windows. (Reason: {Reason}).

Message #

Collection {CollectionId} was blocked from downloading to Windows. (Reason: {Reason})

Fields #

Name	Description
`CollectionId`
`Reason`

Event ID 3026: Storage subscription operation (create/update) failed for {CollectionId} (HRESULT: {HRESULT}).

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

Storage subscription operation (create/update) failed for {CollectionId} (HRESULT: {HRESULT}).

Message #

Storage subscription operation (create/update) failed for {CollectionId} (HRESULT: {HRESULT})

Fields #

Name	Description
`CollectionId`
`HRESULT`

Event ID 3027: Storage subscription operation (delete) failed for {CollectionId} (HRESULT: {HRESULT}).

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

Storage subscription operation (delete) failed for {CollectionId} (HRESULT: {HRESULT}).

Message #

Storage subscription operation (delete) failed for {CollectionId} (HRESULT: {HRESULT})

Fields #

Name	Description
`CollectionId`
`HRESULT`

Event ID 3029: The collection ({CollectionId}) is being throttled due to excessive syncing.

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Debug

Description

The collection ({CollectionId}) is being throttled due to excessive syncing.

Message #

The collection ({CollectionId}) is being throttled due to excessive syncing.

Fields #

Name	Description
`CollectionId`

Event ID 9000

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Analytic

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 9001

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Analytic

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 9002

Provider: Microsoft-Windows-SettingSync-OneDrive
Channel: Analytic

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)