Microsoft-Windows-StateRepository

95 events across 3 channels

Event	Title	Channel	Sample
100	Error ErrorCode: SQL.	Operational	N
101	[P:ProcessId T:ThreadId] Trace: Executing SQL 'SQL'.	Operational	N
102	Error ErrorCode: Failed to open settings at HKLM\Subkey.	Operational	N
103	Error ErrorCode: Failed to read setting Name.	Operational	N
104	Warning ErrorCode: SQL.	Operational	Y
105	Info ErrorCode: SQL.	Operational	Y
106	Error ErrorCode: Failed to write setting Name.	Operational	N
107	CriticalError ErrorCode: SQL.	Operational	N
108	Verbose ErrorCode: SQL.	Operational	N
200	Error ErrorCode: Entity.	Operational	N
201	Error ErrorCode: Entity.	Operational	N
202	Error ErrorCode: Entity.	Operational	N
203	Error ErrorCode: Entity.	Operational	N
204	Error ErrorCode: Entity.	Operational	N
205	Error ErrorCode: Entity.	Operational	N
206	Error ErrorCode: Entity.	Operational	N
207	Error ErrorCode: Entity.	Operational	N
208	Error ErrorCode: Entity.	Operational	N
209	Error ErrorCode: Entity.	Operational	N
210	Error ErrorCode: Entity.	Operational	N
211	Error ErrorCode: Entity.	Operational	N
212	Error ErrorCode: Entity.	Operational	N
213	Error ErrorCode: Entity.	Operational	N
214	Blocking requests [Options=Options, ClientId=ProcessId].	Operational	Y
215	Unblocking requests [Options=Options, ClientId=ProcessId].	Operational	N
216	StateRepository service started [ProcessId=ProcessId].	Operational	Y
217	StateRepository service stopped [ProcessId=ProcessId].	Operational	N
218	Repository initialized [ProcessId=ProcessId].	Debug	N
219	Repository shutdown [ProcessId=ProcessId].	Debug	N
220	Error ErrorCode: Entity.	Operational	N
221	ANALYZE command has run; database statistics are updated [Partition=Partition, …	Operational	Y
222	Error ErrorCode: StateRepository partition Partition creation failed …	Operational	N
223	StateRepository partition Partition exists and ready for use …	Operational	Y
224	StateRepository partition Partition created [SchemaVersion=SchemaVersion].	Operational	N
225	StateRepository partition Partition upgraded [SchemaVersion=FoundSchemaVersion …	Operational	N
226	Error ErrorCode: Failed to raise Changed event on notification channel …	Operational	N
227	Error ErrorCode: StateRepository service failed to start …	Operational	N
228	The StateRepository service is starting.	Operational	N
229	The StateRepository service is starting	Operational	N
230	The StateRepository service is starting.	Operational	N
231	RepositoryManagerServerUpgrade with options: Options.	Operational	Y
232	Error ErrorCode: Entity.	Operational	N
233	Migration starting [Machine: Disposition=MachineDisposition, …	Operational	N
234	Migration completed successfully [Machine: Disposition=MachineDisposition, …	Operational	Y
235	Migration completed: MigratorErrors migrators encountered errors [Machine: …	Operational	N
236	Migrator 'Name' starting.	Operational	N
237	Migrator 'Name' completed successfully.	Operational	N
238	Migrator 'Name' encountered error ErrorCode.	Operational	N
239	Error ErrorCode: Migration encountered an error during Phase.	Operational	N
240	Error ErrorCode: Timeout exceeded accessing Filename: SQL.	Operational	N
241	Error ErrorCode: Timeout exceeded because Filename is in use by ProcessIndex …	Operational	N
242	Waiting TimeoutMSecmsec for requests in progress to complete.	Operational	Y
243	Waited ElapsedTimeMSecmsec for requests in progress to complete.	Operational	Y
244	Timeout exceeded waiting for requests in progress to complete …	Operational	N
245	Maintenance has been performed	Operational	Y
246	Error ErrorCode: Maintenance encountered an error.	Operational	N
247	PreImport: Issue [SchemaVersion=SchemaVersion, Found=Found, Deleted=Deleted, …	Operational	N
248	Error ErrorCode: Failed to create setting Name.	Operational	N
249	Error ErrorCode: Failed to delete setting Name.	Operational	N
250	Error ErrorCode: Database corruption detected in partition Partition …	Operational	N
251	Error ErrorCode: Failed to query StateRepository for PackageFamilyName for user …	Operational	N
252	Error ErrorCode: Failed to scan Name for user UserSID.	Operational	N
253	Error ErrorCode: Failed to delete Name for user UserSID.	Operational	N
254	Error ErrorCode: Completed for user UserSID.	Operational	N
255	Repairs have been performed for user UserSID [Options=Options, Found=Found, …	Operational	N
256	Error ErrorCode: Repair for user UserSID encountered an error [Options=Options, …	Operational	N
257	Repair deleted Context\Name for user UserSID.	Operational	N
258	Repair detected unknown object Context\Name for user UserSID.	Operational	N
259	Count invalid foreign keys detected for Entity.	Operational	Y
260	Count invalid foreign keys detected for Entity.	Operational	N
261	Check repository integrity has been performed [Options=Options, …	Operational	N
262	Error ErrorCode: Check repository integrity encountered an error …	Operational	N
263	Fix repository integrity has been performed [Options=Options, …	Operational	N
264	Error ErrorCode: Fix repository integrity encountered an error [Options=Options, …	Operational	N
265	Checkpoint has been performed	Operational	Y
266	Error ErrorCode: Checkpoint encountered an error.	Operational	N
267	Count invalid foreign keys corrected for Entity.	Operational	Y
268	Count invalid foreign keys corrected for Entity.	Operational	N
269	SRCache successfully initialized [Options=Options].	Operational	Y
270	Error ErrorCode: SRCache initialization encountered an error [Options=Options].	Operational	N
271	SRCache successfully updated [Options=Options].	Operational	Y
272	Error ErrorCode: SRCache update encountered an error [Options=Options].	Operational	N
273	Check cache integrity has been performed [Options=Options, …	Operational	N
274	Error ErrorCode: Check cache integrity encountered an error [Options=Options, …	Operational	N
275	Count missing cache entries detected for Entity [Ids=Ids].	Operational	N
276	Count unexpected cache entries detected for Entity [Ids=Ids].	Operational	N
277	Invalid cache entry detected for Entity [Id=Id, Fields=Fields].	Operational	N
278	Waiting for transaction from TransactionCallerId to complete before setting …	Operational	N
279	Transaction from TransactionCallerId completed.	Operational	N
280	PackageDependency: Category[Index of Count]: Id=Id, UserSid=UserSID, …	Operational	N
281	PackageDependency Summary: Resolved=ResolvedCount, Transient=TransientCount, …	Operational	N
282	Error ErrorCode: Failed to import package status for user UserSid and package …	Operational	N
283	ImportPackageUserStatus completed with hr=ErrorCode.	Operational	N
284	REINDEX command has run; database indices are updated [Partition=Partition, …	Operational	Y
1000	[P:ProcessId T:ThreadId] Profile: ElapsedTime msec to run SQL 'SQL'.	Diagnostic	N

Event ID 100: Error ErrorCode: SQL.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: SQL

Message #

Error %1: %2

Fields #

Name	Description
`ErrorCode` HexInt32
`SQL` AnsiString

Event ID 101: [P:ProcessId T:ThreadId] Trace: Executing SQL 'SQL'.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

[P:ProcessId T:ThreadId] Trace: Executing SQL 'SQL'.

Message #

[P:%2 T:%3] Trace: Executing SQL '%1'

Fields #

Name	Description
`SQL` AnsiString
`ProcessId` UInt32
`ThreadId` UInt32

Event ID 102: Error ErrorCode: Failed to open settings at HKLM\Subkey.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Failed to open settings at HKLM\Subkey.

Message #

Error %1: Failed to open settings at HKLM\%2

Fields #

Name	Description
`ErrorCode` HexInt32
`Subkey` UnicodeString

Event ID 103: Error ErrorCode: Failed to read setting Name.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Failed to read setting Name.

Message #

Error %1: Failed to read setting %2

Fields #

Name	Description
`ErrorCode` HexInt32
`Name` UnicodeString

Event ID 104: Warning ErrorCode: SQL.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Level: Warning
Task: StateRepository.Task.DataAccessLayer

Description

Warning ErrorCode: SQL

Message #

Warning %1: %2

Fields #

Name	Description
`ErrorCode` HexInt32
`SQL` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StateRepository",
    "guid": "89592015-D996-4636-8F61-066B5D4DD739",
    "event_source_name": "",
    "event_id": 104,
    "version": 0,
    "level": 3,
    "task": 1,
    "opcode": 0,
    "keywords": 4611686018427387905,
    "time_created": "2026-02-12T04:58:02.340067+00:00",
    "event_record_id": 2326,
    "correlation": {
      "ActivityID": "43A6D212-9A2A-000C-4A21-A9432A9ADC01"
    },
    "execution": {
      "process_id": 9772,
      "thread_id": 11932
    },
    "channel": "Microsoft-Windows-StateRepository/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ErrorCode": "0x80670007",
    "SQL": "[sqlite3_exec] #5 Database 258B8E48A70: Try 1 (351ms) {90C40975-20C3-4EE8-817F-925B82C1D262} Cpu:8 Mem:5 Io:2 TID:11968 database is locked : SQL BEGIN EXCLUSIVE /*02C51573-873D-451F-AA58-23BF3327583E*/;"
  },
  "message": ""
}

Event ID 105: Info ErrorCode: SQL.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Level: Informational
Task: StateRepository.Task.DataAccessLayer

Description

Info ErrorCode: SQL

Message #

Info %1: %2

Fields #

Name	Description
`ErrorCode` HexInt32
`SQL` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StateRepository",
    "guid": "{89592015-D996-4636-8F61-066B5D4DD739}",
    "event_source_name": "",
    "event_id": 105,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 4611686018427387905,
    "time_created": "2026-05-28T22:41:57.2143700+00:00",
    "event_record_id": 337,
    "correlation": {},
    "execution": {
      "process_id": 3696,
      "thread_id": 3996
    },
    "channel": "Microsoft-Windows-StateRepository/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ErrorCode": "0x11b",
    "SQL": "recovered 16 frames from WAL file C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd-wal"
  },
  "message": "Info 0x11B: recovered 16 frames from WAL file C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd-wal"
}

Event ID 106: Error ErrorCode: Failed to write setting Name.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Failed to write setting Name.

Message #

Error %1: Failed to write setting %2

Fields #

Name	Description
`ErrorCode` HexInt32
`Name` UnicodeString

Event ID 107: CriticalError ErrorCode: SQL.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

CriticalError ErrorCode: SQL.

Message #

CriticalError %1: %2

Fields #

Name	Description
`ErrorCode` HexInt32
`SQL` AnsiString

Event ID 108: Verbose ErrorCode: SQL.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Verbose ErrorCode: SQL

Message #

Verbose %1: %2

Fields #

Name	Description
`ErrorCode` HexInt32
`SQL` AnsiString

Event ID 200: Error ErrorCode: Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Entity.Method() failed [WorkId=WorkId].

Message #

Error %1: %2.%3() failed [WorkId=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Entity` AnsiString
`Method` AnsiString
`WorkId` Int64

Event ID 201: Error ErrorCode: Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Entity.Method(Id=Id, Revision=Revision) failed [WorkId=WorkId].

Message #

Error %1: %2.%3(Id=%5, Revision=%6) failed [WorkId=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Entity` AnsiString
`Method` AnsiString
`WorkId` Int64
`Id` Int64
`Revision` UInt64

Event ID 202: Error ErrorCode: Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Entity.Method(Id=Id) failed [WorkId=WorkId].

Message #

Error %1: %2.%3(Id=%5) failed [WorkId=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Entity` AnsiString
`Method` AnsiString
`WorkId` Int64
`Id` Int64

Event ID 203: Error ErrorCode: Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Entity.Method(Id=Id) failed [WorkId=WorkId].

Message #

Error %1: %2.%3(Id=%5) failed [WorkId=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Entity` AnsiString
`Method` AnsiString
`WorkId` Int64
`Id` Int64

Event ID 204: Error ErrorCode: Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Entity.Method() failed [WorkId=WorkId].

Message #

Error %1: %2.%3() failed [WorkId=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Entity` AnsiString
`Method` AnsiString
`WorkId` Int64

Event ID 205: Error ErrorCode: Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Entity.Method(Id=Id) failed [WorkId=WorkId].

Message #

Error %1: %2.%3(Id=%5) failed [WorkId=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Entity` AnsiString
`Method` AnsiString
`WorkId` Int64
`Id` Int64

Event ID 206: Error ErrorCode: Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Entity.Method failed [WorkId=WorkId].

Message #

Error %1: %2.%3 failed [WorkId=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Entity` AnsiString
`Method` AnsiString
`WorkId` Int64

Event ID 207: Error ErrorCode: Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Entity.Method() failed [WorkId=WorkId].

Message #

Error %1: %2.%3() failed [WorkId=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Entity` AnsiString
`Method` AnsiString
`WorkId` Int64

Event ID 208: Error ErrorCode: Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Entity.Method(Id=Id) failed [WorkId=WorkId].

Message #

Error %1: %2.%3(Id=%5) failed [WorkId=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Entity` AnsiString
`Method` AnsiString
`WorkId` Int64
`Id` Int64

Event ID 209: Error ErrorCode: Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Entity.Method failed [WorkId=WorkId].

Message #

Error %1: %2.%3 failed [WorkId=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Entity` AnsiString
`Method` AnsiString
`WorkId` Int64

Event ID 210: Error ErrorCode: Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Entity.Method failed [WorkId=WorkId].

Message #

Error %1: %2.%3 failed [WorkId=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Entity` AnsiString
`Method` AnsiString
`WorkId` Int64

Event ID 211: Error ErrorCode: Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Entity.Method(Id=Id) failed [WorkId=WorkId].

Message #

Error %1: %2.%3(Id=%5) failed [WorkId=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Entity` AnsiString
`Method` AnsiString
`WorkId` Int64
`Id` Int64

Event ID 212: Error ErrorCode: Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Entity.Method failed [WorkId=WorkId].

Message #

Error %1: %2.%3 failed [WorkId=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Entity` AnsiString
`Method` AnsiString
`WorkId` Int64

Event ID 213: Error ErrorCode: Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

Error ErrorCode: Entity.Method failed [ClientId=ClientId].

Message #

Error %1: %2.%3 failed [ClientId=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Entity` AnsiString
`Method` AnsiString
`ClientId` UInt32

Event ID 214: Blocking requests [Options=Options, ClientId=ProcessId].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Level: Warning
Task: StateRepository.Task.WinRTAPI

Description

Blocking requests [Options=Options, ClientId=ProcessId].

Message #

Blocking requests [Options=%1, ClientId=%2]

Fields #

Name	Description
`Options` HexInt32
`ProcessId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StateRepository",
    "guid": "89592015-D996-4636-8F61-066B5D4DD739",
    "event_source_name": "",
    "event_id": 214,
    "version": 0,
    "level": 3,
    "task": 2,
    "opcode": 0,
    "keywords": 4611686018427387905,
    "time_created": "2023-10-25T22:55:29.458620+00:00",
    "event_record_id": 1169,
    "correlation": {},
    "execution": {
      "process_id": 2396,
      "thread_id": 6812
    },
    "channel": "Microsoft-Windows-StateRepository/Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Options": "0x1",
    "ProcessId": 4544
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 215: Unblocking requests [Options=Options, ClientId=ProcessId].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

Unblocking requests [Options=Options, ClientId=ProcessId].

Message #

Unblocking requests [Options=%1, ClientId=%2]

Fields #

Name	Description
`Options` HexInt32
`ProcessId` UInt32

Event ID 216: StateRepository service started [ProcessId=ProcessId].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Level: Informational
Task: StateRepository.Task.WinRTAPI

Description

StateRepository service started [ProcessId=ProcessId].

Message #

StateRepository service started [ProcessId=%1]

Fields #

Name	Description
`ProcessId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StateRepository",
    "guid": "{89592015-D996-4636-8F61-066B5D4DD739}",
    "event_source_name": "",
    "event_id": 216,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 4611686018427387905,
    "time_created": "2026-05-29T16:33:17.2115459+00:00",
    "event_record_id": 381,
    "correlation": {},
    "execution": {
      "process_id": 3572,
      "thread_id": 3764
    },
    "channel": "Microsoft-Windows-StateRepository/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ProcessId": "3572"
  },
  "message": "StateRepository service started [ProcessId=3572]"
}

Event ID 217: StateRepository service stopped [ProcessId=ProcessId].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

StateRepository service stopped [ProcessId=ProcessId].

Message #

StateRepository service stopped [ProcessId=%1]

Fields #

Name	Description
`ProcessId` UInt32

Event ID 218: Repository initialized [ProcessId=ProcessId].

Provider: Microsoft-Windows-StateRepository
Channel: Debug
Task: StateRepository.Task.WinRTAPI

Description

Repository initialized [ProcessId=ProcessId].

Message #

Repository initialized [ProcessId=%1]

Fields #

Name	Description
`ProcessId` UInt32
`ThreadId` UInt32

Event ID 219: Repository shutdown [ProcessId=ProcessId].

Provider: Microsoft-Windows-StateRepository
Channel: Debug
Task: StateRepository.Task.WinRTAPI

Description

Repository shutdown [ProcessId=ProcessId].

Message #

Repository shutdown [ProcessId=%1]

Fields #

Name	Description
`ProcessId` UInt32
`ThreadId` UInt32

Event ID 220: Error ErrorCode: Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Entity.Method() failed [WorkId=WorkId].

Message #

Error %1: %2.%3() failed [WorkId=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Entity` AnsiString
`Method` AnsiString
`WorkId` Int64

Event ID 221: ANALYZE command has run; database statistics are updated [Partition=Partition, ProcessId=ProcessId, Scope=Scope].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Level: Verbose
Task: StateRepository.Task.WinRTAPI

Description

ANALYZE command has run; database statistics are updated [Partition=Partition, ProcessId=ProcessId, Scope=Scope].

Message #

ANALYZE command has run; database statistics are updated [Partition=%1, ProcessId=%2, Scope=%3]

Fields #

Name	Description
`Partition` Int32
`ProcessId` UInt32
`Scope` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StateRepository",
    "guid": "{89592015-D996-4636-8F61-066B5D4DD739}",
    "event_source_name": "",
    "event_id": 221,
    "version": 0,
    "level": 5,
    "task": 2,
    "opcode": 0,
    "keywords": 4611686018427387905,
    "time_created": "2026-06-13T05:45:50.9535662+00:00",
    "event_record_id": 391,
    "correlation": {
      "ActivityID": "{C6821FB2-EF88-0003-695B-82C688EFDC01}"
    },
    "execution": {
      "process_id": 1492,
      "thread_id": 7976
    },
    "channel": "Microsoft-Windows-StateRepository/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Partition": "2",
    "ProcessId": "1492"
  },
  "message": "ANALYZE command has run; database statistics are updated [Partition=2, ProcessId=1492]"
}

Event ID 222: Error ErrorCode: StateRepository partition Partition creation failed [Filename=Filename, Disposition=Disposition, FoundSchemaVersion=FoundSchemaVersion, TargetSchemaVersion=CreatedSchemaVersion].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

Error ErrorCode: StateRepository partition Partition creation failed [Filename=Filename, Disposition=Disposition, FoundSchemaVersion=FoundSchemaVersion, TargetSchemaVersion=CreatedSchemaVersion].

Message #

Error %1: StateRepository partition %2 creation failed [Filename=%3, Disposition=%4, FoundSchemaVersion=%5, TargetSchemaVersion=%6]

Fields #

Name	Description
`ErrorCode` HexInt32
`Partition` Int32
`Filename` UnicodeString
`Disposition` Int32
`FoundSchemaVersion` Int32
`CreatedSchemaVersion` Int32

Event ID 223: StateRepository partition Partition exists and ready for use [SchemaVersion=SchemaVersion].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Level: Informational
Task: StateRepository.Task.WinRTAPI

Description

StateRepository partition Partition exists and ready for use [SchemaVersion=SchemaVersion].

Message #

StateRepository partition %1 exists and ready for use [SchemaVersion=%2]

Fields #

Name	Description
`Partition` Int32
`SchemaVersion` Int32
`Filename` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StateRepository",
    "guid": "{89592015-D996-4636-8F61-066B5D4DD739}",
    "event_source_name": "",
    "event_id": 223,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 4611686018427387905,
    "time_created": "2026-05-29T16:33:06.4518409+00:00",
    "event_record_id": 370,
    "correlation": {},
    "execution": {
      "process_id": 3572,
      "thread_id": 3764
    },
    "channel": "Microsoft-Windows-StateRepository/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Partition": "2",
    "SchemaVersion": "24064",
    "Filename": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Deployment.srd"
  },
  "message": "StateRepository partition 2 exists and ready for use [SchemaVersion=24064]"
}

Event ID 224: StateRepository partition Partition created [SchemaVersion=SchemaVersion].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

StateRepository partition Partition created [SchemaVersion=SchemaVersion].

Message #

StateRepository partition %1 created [SchemaVersion=%2]

Fields #

Name	Description
`Partition` Int32
`SchemaVersion` Int32
`Filename` UnicodeString

Event ID 225: StateRepository partition Partition upgraded [SchemaVersion=FoundSchemaVersion -> SchemaVersion].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

StateRepository partition Partition upgraded [SchemaVersion=FoundSchemaVersion -> SchemaVersion].

Message #

StateRepository partition %1 upgraded [SchemaVersion=%3 -> %2]

Fields #

Name	Description
`Partition` Int32
`SchemaVersion` Int32
`FoundSchemaVersion` Int32
`Filename` UnicodeString

Event ID 226: Error ErrorCode: Failed to raise Changed event on notification channel ChannelName for user UserSid.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

Error ErrorCode: Failed to raise Changed event on notification channel ChannelName for user UserSid.

Message #

Error %1: Failed to raise Changed event on notification channel %2 for user %3

Fields #

Name	Description
`ErrorCode` HexInt32
`ChannelName` UnicodeString
`UserSid` UnicodeString

Event ID 227: Error ErrorCode: StateRepository service failed to start [Checkpoint=Checkpoint].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

Error ErrorCode: StateRepository service failed to start [Checkpoint=Checkpoint].

Message #

Error %1: StateRepository service failed to start [Checkpoint=%2]

Fields #

Name	Description
`ErrorCode` HexInt32
`Checkpoint` Int32

Event ID 228: The StateRepository service is starting.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

The StateRepository service is starting. The service's last known status cannot be determined [LastStatus=LastKnownStatus].

Message #

The StateRepository service is starting. The service's last known status cannot be determined [LastStatus=%1]

Fields #

Name	Description
`LastKnownStatus` Int32

Event ID 229: The StateRepository service is starting

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

The StateRepository service is starting.

Message #

The StateRepository service is starting

Fields #

Name	Description
`LastKnownStatus` Int32

Event ID 230: The StateRepository service is starting.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

The StateRepository service is starting. The service did not complete its shutdown work when previously active [LastStatus=LastKnownStatus].

Message #

The StateRepository service is starting. The service did not complete its shutdown work when previously active [LastStatus=%1]

Fields #

Name	Description
`LastKnownStatus` Int32

Event ID 231: RepositoryManagerServerUpgrade with options: Options.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Level: Verbose
Task: StateRepository.Task.WinRTAPI

Description

RepositoryManagerServerUpgrade with options: Options.

Message #

RepositoryManagerServerUpgrade with options: %1

Fields #

Name	Description
`Options` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StateRepository",
    "guid": "{89592015-D996-4636-8F61-066B5D4DD739}",
    "event_source_name": "",
    "event_id": 231,
    "version": 0,
    "level": 5,
    "task": 2,
    "opcode": 0,
    "keywords": 4611686018427387905,
    "time_created": "2026-06-13T05:39:37.6462549+00:00",
    "event_record_id": 389,
    "correlation": {},
    "execution": {
      "process_id": 3572,
      "thread_id": 2788
    },
    "channel": "Microsoft-Windows-StateRepository/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Options": "0x1"
  },
  "message": "RepositoryManagerServerUpgrade with options: 0x1"
}

Event ID 232: Error ErrorCode: Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Entity.Method failed [WorkId=WorkId].

Message #

Error %1: %2.%3 failed [WorkId=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Entity` AnsiString
`Method` AnsiString
`WorkId` Int64

Event ID 233: Migration starting [Machine: Disposition=MachineDisposition, PreviousVersion=PreviousMachineVersion, Deployment: Disposition=DeploymentDisposition, PreviousVersion=PreviousDeploymentVersion.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.Migrate

Description

Migration starting [Machine: Disposition=MachineDisposition, PreviousVersion=PreviousMachineVersion, Deployment: Disposition=DeploymentDisposition, PreviousVersion=PreviousDeploymentVersion.

Message #

Migration starting [Machine: Disposition=%1, PreviousVersion=%2, Deployment: Disposition=%3, PreviousVersion=%4

Fields #

Name	Description
`MachineDisposition` Int32
`PreviousMachineVersion` Int32
`DeploymentDisposition` Int32
`PreviousDeploymentVersion` Int32

Event ID 234: Migration completed successfully [Machine: Disposition=MachineDisposition, PreviousVersion=PreviousMachineVersion] [Deployment: Disposition=DeploymentDisposition, PreviousVersion=PreviousDeployment...

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Level: Informational
Task: StateRepository.Task.Migrate

Description

Migration completed successfully [Machine: Disposition=MachineDisposition, PreviousVersion=PreviousMachineVersion] [Deployment: Disposition=DeploymentDisposition, PreviousVersion=PreviousDeploymentVersion].

Message #

Migration completed successfully [Machine: Disposition=%1, PreviousVersion=%2] [Deployment: Disposition=%3, PreviousVersion=%4]

Fields #

Name	Description
`MachineDisposition` Int32
`PreviousMachineVersion` Int32
`DeploymentDisposition` Int32
`PreviousDeploymentVersion` Int32
`MigratorErrors` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StateRepository",
    "guid": "89592015-D996-4636-8F61-066B5D4DD739",
    "event_source_name": "",
    "event_id": 234,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 0,
    "keywords": 4611686018427387905,
    "time_created": "2023-11-06T06:21:57.817957+00:00",
    "event_record_id": 1174,
    "correlation": {},
    "execution": {
      "process_id": 1496,
      "thread_id": 1516
    },
    "channel": "Microsoft-Windows-StateRepository/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "MachineDisposition": 1,
    "PreviousMachineVersion": 0,
    "DeploymentDisposition": 1,
    "PreviousDeploymentVersion": 0,
    "MigratorErrors": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 235: Migration completed: MigratorErrors migrators encountered errors [Machine: Disposition=MachineDisposition, PreviousVersion=PreviousMachineVersion] [Deployment: Disposition=DeploymentDisposition, Pr...

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.Migrate

Description

Migration completed: MigratorErrors migrators encountered errors [Machine: Disposition=MachineDisposition, PreviousVersion=PreviousMachineVersion] [Deployment: Disposition=DeploymentDisposition, PreviousVersion=PreviousDeploymentVersion].

Message #

Migration completed: %5 migrators encountered errors [Machine: Disposition=%1, PreviousVersion=%2] [Deployment: Disposition=%3, PreviousVersion=%4]

Fields #

Name	Description
`MachineDisposition` Int32
`PreviousMachineVersion` Int32
`DeploymentDisposition` Int32
`PreviousDeploymentVersion` Int32
`MigratorErrors` Int32

Event ID 236: Migrator 'Name' starting.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.Migrate

Description

Migrator 'Name' starting.

Message #

Migrator '%1' starting

Fields #

Name	Description
`Name` UnicodeString

Event ID 237: Migrator 'Name' completed successfully.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.Migrate

Description

Migrator 'Name' completed successfully.

Message #

Migrator '%1' completed successfully

Fields #

Name	Description
`Name` UnicodeString

Event ID 238: Migrator 'Name' encountered error ErrorCode.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.Migrate

Description

Migrator 'Name' encountered error ErrorCode.

Message #

Migrator '%2' encountered error %1

Fields #

Name	Description
`ErrorCode` HexInt32
`Name` UnicodeString

Event ID 239: Error ErrorCode: Migration encountered an error during Phase.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.Migrate

Description

Error ErrorCode: Migration encountered an error during Phase.

Message #

Error %1: Migration encountered an error during %2

Fields #

Name	Description
`ErrorCode` HexInt32
`Phase` UnicodeString

Event ID 240: Error ErrorCode: Timeout exceeded accessing Filename: SQL.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Timeout exceeded accessing Filename: SQL.

Message #

Error %1: Timeout exceeded accessing %2: %3

Fields #

Name	Description
`ErrorCode` HexInt32
`Filename` AnsiString
`SQL` AnsiString
`TransactionCallerId` GUID
`Priorities` UnicodeString

Event ID 241: Error ErrorCode: Timeout exceeded because Filename is in use by ProcessIndex process(es).

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error : Timeout exceeded because is in use by process(es). Process[] = processid , application , package , executable , user username /, session , commandline.

Message #

Error %1: Timeout exceeded because %2 is in use by %3 process(es). Process[%4] = processid %5, application %6, package %7, executable %8, user %9 username %10/%11, session %12, commandline %13

Fields #

Name	Description
`ErrorCode` HexInt32
`Filename` AnsiString
`ProcessIndex` UInt32
`ProcessCount` UInt32
`ProcessId` UInt32
`ApplicationUserModelId` UnicodeString
`PackageFullName` UnicodeString
`ExecutableName` UnicodeString
`UserSID` UnicodeString
`UserDomain` UnicodeString
`UserName` UnicodeString
`SessionId` UInt32
`CommandLine` UnicodeString

Event ID 242: Waiting TimeoutMSecmsec for requests in progress to complete.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Level: Verbose
Task: StateRepository.Task.DataAccessLayer

Description

Waiting TimeoutMSecmsec for requests in progress to complete.

Message #

Waiting %1msec for requests in progress to complete

Fields #

Name	Description
`TimeoutMSec` UInt64
`ElapsedTimeMSec` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StateRepository",
    "guid": "{89592015-D996-4636-8F61-066B5D4DD739}",
    "event_source_name": "",
    "event_id": 242,
    "version": 0,
    "level": 5,
    "task": 1,
    "opcode": 0,
    "keywords": 4611686018427387905,
    "time_created": "2026-06-13T05:22:34.5297625+00:00",
    "event_record_id": 391,
    "correlation": {},
    "execution": {
      "process_id": 3728,
      "thread_id": 7968
    },
    "channel": "Microsoft-Windows-StateRepository/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TimeoutMSec": "5000",
    "ElapsedTimeMSec": "0"
  },
  "message": "Waiting 5000msec for requests in progress to complete"
}

Event ID 243: Waited ElapsedTimeMSecmsec for requests in progress to complete.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Level: Verbose
Task: StateRepository.Task.DataAccessLayer

Description

Waited ElapsedTimeMSecmsec for requests in progress to complete.

Message #

Waited %2msec for requests in progress to complete

Fields #

Name	Description
`TimeoutMSec` UInt64
`ElapsedTimeMSec` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StateRepository",
    "guid": "{89592015-D996-4636-8F61-066B5D4DD739}",
    "event_source_name": "",
    "event_id": 243,
    "version": 0,
    "level": 5,
    "task": 1,
    "opcode": 0,
    "keywords": 4611686018427387905,
    "time_created": "2026-06-13T05:22:34.5297640+00:00",
    "event_record_id": 392,
    "correlation": {},
    "execution": {
      "process_id": 3728,
      "thread_id": 7968
    },
    "channel": "Microsoft-Windows-StateRepository/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TimeoutMSec": "5000",
    "ElapsedTimeMSec": "0"
  },
  "message": "Waited 0msec for requests in progress to complete"
}

Event ID 244: Timeout exceeded waiting for requests in progress to complete [Timeout=TimeoutMSecmsec, Elapsed=ElapsedTimeMSecmsec].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Timeout exceeded waiting for requests in progress to complete [Timeout=TimeoutMSecmsec, Elapsed=ElapsedTimeMSecmsec].

Message #

Timeout exceeded waiting for requests in progress to complete [Timeout=%1msec, Elapsed=%2msec]

Fields #

Name	Description
`TimeoutMSec` UInt64
`ElapsedTimeMSec` UInt64

Event ID 245: Maintenance has been performed

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Level: Verbose
Task: StateRepository.Task.WinRTAPI

Description

Maintenance has been performed.

Message #

Maintenance has been performed

Fields #

Name	Description
`ErrorCode` HexInt32
`MachineSize_Before` Int64
`MachineJournalSize_Before` Int64
`DeploymentSize_Before` Int64
`DeploymentJournalSize_Before` Int64
`MachineSize_After` Int64
`MachineJournalSize_After` Int64
`DeploymentSize_After` Int64
`DeploymentJournalSize_After` Int64
`MaintenancePerformed` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StateRepository",
    "guid": "{89592015-D996-4636-8F61-066B5D4DD739}",
    "event_source_name": "",
    "event_id": 245,
    "version": 0,
    "level": 5,
    "task": 2,
    "opcode": 0,
    "keywords": 4611686018427387905,
    "time_created": "2026-05-29T16:33:16.8803327+00:00",
    "event_record_id": 379,
    "correlation": {},
    "execution": {
      "process_id": 3572,
      "thread_id": 3764
    },
    "channel": "Microsoft-Windows-StateRepository/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ErrorCode": "0x0",
    "MachineSize_Before": "1048576",
    "MachineJournalSize_Before": "0",
    "DeploymentSize_Before": "1048576",
    "DeploymentJournalSize_Before": "0",
    "MachineSize_After": "1048576",
    "MachineJournalSize_After": "0",
    "DeploymentSize_After": "1048576",
    "DeploymentJournalSize_After": "4096"
  },
  "message": "Maintenance has been performed"
}

Event ID 246: Error ErrorCode: Maintenance encountered an error.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

Error ErrorCode: Maintenance encountered an error.

Message #

Error %1: Maintenance encountered an error

Fields #

Name	Description
`ErrorCode` HexInt32
`MachineSize_Before` Int64
`MachineJournalSize_Before` Int64
`DeploymentSize_Before` Int64
`DeploymentJournalSize_Before` Int64
`MachineSize_After` Int64
`MachineJournalSize_After` Int64
`DeploymentSize_After` Int64
`DeploymentJournalSize_After` Int64
`MaintenancePerformed` HexInt32

Event ID 247: PreImport: Issue [SchemaVersion=SchemaVersion, Found=Found, Deleted=Deleted, Id(s)=Id].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

PreImport: Issue [SchemaVersion=SchemaVersion, Found=Found, Deleted=Deleted, Id(s)=Id].

Message #

PreImport: %4 [SchemaVersion=%2, Found=%5, Deleted=%7, Id(s)=%6]

Fields #

Name	Description
`Partition` Int32
`SchemaVersion` Int32
`Filename` AnsiString
`Issue` UnicodeString
`Found` Int32
`Id` UnicodeString
`Deleted` Int32

Event ID 248: Error ErrorCode: Failed to create setting Name.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Failed to create setting Name.

Message #

Error %1: Failed to create setting %2

Fields #

Name	Description
`ErrorCode` HexInt32
`Name` UnicodeString

Event ID 249: Error ErrorCode: Failed to delete setting Name.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Failed to delete setting Name.

Message #

Error %1: Failed to delete setting %2

Fields #

Name	Description
`ErrorCode` HexInt32
`Name` UnicodeString

Event ID 250: Error ErrorCode: Database corruption detected in partition Partition [Action=Action, Try#=Try, Elapsed=ElapsedTimeMSecmsec, Uptime=FirstReportedUptime, FirstReported=FirstReportedWhen].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Database corruption detected in partition Partition [Action=Action, Try#=Try, Elapsed=ElapsedTimeMSecmsec, Uptime=FirstReportedUptime, FirstReported=FirstReportedWhen].

Message #

Error %1: Database corruption detected in partition %3 [Action=%2, Try#=%6, Elapsed=%7msec, Uptime=%8, FirstReported=%9]

Fields #

Name	Description
`ErrorCode` HexInt32
`Action` AnsiString
`Partition` Int32
`Filename` AnsiString
`SQL` AnsiString
`Try` UInt64
`ElapsedTimeMSec` UInt64
`FirstReportedUptime` UInt64
`FirstReportedWhen` UInt64

Event ID 251: Error ErrorCode: Failed to query StateRepository for PackageFamilyName for user UserSID.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Failed to query StateRepository for PackageFamilyName for user UserSID.

Message #

Error %1: Failed to query StateRepository for %3 for user %2

Fields #

Name	Description
`ErrorCode` HexInt32
`UserSID` UnicodeString
`PackageFamilyName` UnicodeString

Event ID 252: Error ErrorCode: Failed to scan Name for user UserSID.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Failed to scan Name for user UserSID.

Message #

Error %1: Failed to scan %3 for user %2

Fields #

Name	Description
`ErrorCode` HexInt32
`UserSID` UnicodeString
`Name` UnicodeString

Event ID 253: Error ErrorCode: Failed to delete Name for user UserSID.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Failed to delete Name for user UserSID.

Message #

Error %1: Failed to delete %3 for user %2

Fields #

Name	Description
`ErrorCode` HexInt32
`UserSID` UnicodeString
`Name` UnicodeString

Event ID 254: Error ErrorCode: Completed for user UserSID.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Completed for user UserSID.

Message #

Error %1: Completed for user %2

Fields #

Name	Description
`ErrorCode` HexInt32
`UserSID` UnicodeString

Event ID 255: Repairs have been performed for user UserSID [Options=Options, Found=Found, Deleted=Deleted].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

Repairs have been performed for user UserSID [Options=Options, Found=Found, Deleted=Deleted].

Message #

Repairs have been performed for user %2 [Options=%3, Found=%4, Deleted=%5]

Fields #

Name	Description
`ErrorCode` HexInt32
`UserSID` UnicodeString
`Options` HexInt32
`Found` UInt32
`Deleted` UInt32

Event ID 256: Error ErrorCode: Repair for user UserSID encountered an error [Options=Options, Found=Found, Deleted=Deleted].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

Error ErrorCode: Repair for user UserSID encountered an error [Options=Options, Found=Found, Deleted=Deleted].

Message #

Error %1: Repair for user %2 encountered an error [Options=%3, Found=%4, Deleted=%5]

Fields #

Name	Description
`ErrorCode` HexInt32
`UserSID` UnicodeString
`Options` HexInt32
`Found` UInt32
`Deleted` UInt32

Event ID 257: Repair deleted Context\Name for user UserSID.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Repair deleted Context\Name for user UserSID.

Message #

Repair deleted %4\%3 for user %2

Fields #

Name	Description
`ErrorCode` HexInt32
`UserSID` UnicodeString
`Name` UnicodeString
`Context` UnicodeString

Event ID 258: Repair detected unknown object Context\Name for user UserSID.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Repair detected unknown object Context\Name for user UserSID.

Message #

Repair detected unknown object %3\%2 for user %1

Fields #

Name	Description
`UserSID` UnicodeString
`Name` UnicodeString
`Context` UnicodeString

Event ID 259: Count invalid foreign keys detected for Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Level: Warning
Task: StateRepository.Task.DataAccessLayer

Description

Count invalid foreign keys detected for Entity.Field [Filename=Filename, Ids=Ids].

Message #

%5 invalid foreign keys detected for %1.%2 [Filename=%3, Ids=%6]

Fields #

Name	Description
`Entity` AnsiString
`Field` AnsiString
`Filename` AnsiString
`SQL` AnsiString
`Count` UInt64
`Ids` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StateRepository",
    "guid": "89592015-D996-4636-8F61-066B5D4DD739",
    "event_source_name": "",
    "event_id": 259,
    "version": 0,
    "level": 3,
    "task": 1,
    "opcode": 0,
    "keywords": 4611756387171565569,
    "time_created": "2026-02-18T21:51:27.389192+00:00",
    "event_record_id": 2524,
    "correlation": {
      "ActivityID": "A84E255E-A05B-000B-B669-4EA85BA0DC01"
    },
    "execution": {
      "process_id": 9436,
      "thread_id": 316
    },
    "channel": "Microsoft-Windows-StateRepository/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Entity": "WowDependencyGraph",
    "Field": "DependentPackage",
    "Filename": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd",
    "SQL": "SELECT COUNT(*), GROUP_CONCAT(rowid) FROM WowDependencyGraph WHERE (DependentPackage>0) AND (DependentPackage NOT IN (SELECT _PackageID FROM Package));",
    "Count": 2,
    "Ids": "303,304"
  },
  "message": ""
}

Event ID 260: Count invalid foreign keys detected for Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Count invalid foreign keys detected for Entity.Field [Filename=Filename, Ids=Ids].

Message #

%5 invalid foreign keys detected for %1.%2 [Filename=%3, Ids=%6]

Fields #

Name	Description
`Entity` AnsiString
`Field` AnsiString
`Filename` AnsiString
`SQL` AnsiString
`Count` UInt64
`Ids` AnsiString

Event ID 261: Check repository integrity has been performed [Options=Options, Disposition=Disposition, ErrorsDetected=ErrorCount].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Check repository integrity has been performed [Options=Options, Disposition=Disposition, ErrorsDetected=ErrorCount].

Message #

Check repository integrity has been performed [Options=%2, Disposition=%3, ErrorsDetected=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Options` HexInt32
`Disposition` Int32
`ErrorCount` UInt64

Event ID 262: Error ErrorCode: Check repository integrity encountered an error [Options=Options, Disposition=Disposition, ErrorsDetected=ErrorCount].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Check repository integrity encountered an error [Options=Options, Disposition=Disposition, ErrorsDetected=ErrorCount].

Message #

Error %1: Check repository integrity encountered an error [Options=%2, Disposition=%3, ErrorsDetected=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Options` HexInt32
`Disposition` Int32
`ErrorCount` UInt64

Event ID 263: Fix repository integrity has been performed [Options=Options, ErrorsCorrected=FixCount].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Fix repository integrity has been performed [Options=Options, ErrorsCorrected=FixCount].

Message #

Fix repository integrity has been performed [Options=%2, ErrorsCorrected=%3]

Fields #

Name	Description
`ErrorCode` HexInt32
`Options` HexInt32
`FixCount` UInt64

Event ID 264: Error ErrorCode: Fix repository integrity encountered an error [Options=Options, ErrorsCorrected=FixCount].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Fix repository integrity encountered an error [Options=Options, ErrorsCorrected=FixCount].

Message #

Error %1: Fix repository integrity encountered an error [Options=%2, ErrorsCorrected=%3]

Fields #

Name	Description
`ErrorCode` HexInt32
`Options` HexInt32
`FixCount` UInt64

Event ID 265: Checkpoint has been performed

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Level: Verbose
Task: StateRepository.Task.WinRTAPI

Description

Checkpoint has been performed.

Message #

Checkpoint has been performed

Fields #

Name	Description
`ErrorCode` HexInt32
`Options` HexInt32
`MachineDatabase_Pages` Int32
`MachineDatabase_PagesCheckpointed` Int32
`DeploymentDatabase_Pages` Int32
`DeploymentDatabase_PagesCheckpointed` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StateRepository",
    "guid": "{89592015-D996-4636-8F61-066B5D4DD739}",
    "event_source_name": "",
    "event_id": 265,
    "version": 0,
    "level": 5,
    "task": 2,
    "opcode": 0,
    "keywords": 4611721202799476737,
    "time_created": "2026-05-28T22:41:57.3363970+00:00",
    "event_record_id": 338,
    "correlation": {},
    "execution": {
      "process_id": 3696,
      "thread_id": 3996
    },
    "channel": "Microsoft-Windows-StateRepository/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ErrorCode": "0x0",
    "Options": "0x0",
    "MachineDatabase_Pages": "0",
    "MachineDatabase_PagesCheckpointed": "0",
    "DeploymentDatabase_Pages": "0",
    "DeploymentDatabase_PagesCheckpointed": "0"
  },
  "message": "Checkpoint has been performed"
}

Event ID 266: Error ErrorCode: Checkpoint encountered an error.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

Error ErrorCode: Checkpoint encountered an error.

Message #

Error %1: Checkpoint encountered an error

Fields #

Name	Description
`ErrorCode` HexInt32
`Options` HexInt32
`MachineDatabase_Pages` Int32
`MachineDatabase_PagesCheckpointed` Int32
`DeploymentDatabase_Pages` Int32
`DeploymentDatabase_PagesCheckpointed` Int32

Event ID 267: Count invalid foreign keys corrected for Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Level: Informational
Task: StateRepository.Task.DataAccessLayer

Description

Count invalid foreign keys corrected for Entity.Field [Filename=Filename].

Message #

%5 invalid foreign keys corrected for %1.%2 [Filename=%3]

Fields #

Name	Description
`Entity` AnsiString
`Field` AnsiString
`Filename` AnsiString
`SQL` AnsiString
`Count` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StateRepository",
    "guid": "89592015-D996-4636-8F61-066B5D4DD739",
    "event_source_name": "",
    "event_id": 267,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 4611721202799476737,
    "time_created": "2026-02-18T21:51:27.416069+00:00",
    "event_record_id": 2526,
    "correlation": {
      "ActivityID": "A84E255E-A05B-000B-B669-4EA85BA0DC01"
    },
    "execution": {
      "process_id": 9436,
      "thread_id": 316
    },
    "channel": "Microsoft-Windows-StateRepository/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Entity": "WowDependencyGraph",
    "Field": "DependentPackage",
    "Filename": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd",
    "SQL": "DELETE FROM WowDependencyGraph WHERE (DependentPackage>0) AND (DependentPackage NOT IN (SELECT _PackageID FROM Package));",
    "Count": 2
  },
  "message": ""
}

Event ID 268: Count invalid foreign keys corrected for Entity.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Count invalid foreign keys corrected for Entity.Field [Filename=Filename].

Message #

%5 invalid foreign keys corrected for %1.%2 [Filename=%3]

Fields #

Name	Description
`Entity` AnsiString
`Field` AnsiString
`Filename` AnsiString
`SQL` AnsiString
`Count` UInt64

Event ID 269: SRCache successfully initialized [Options=Options].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Level: Verbose
Task: StateRepository.Task.WinRTAPI

Description

SRCache successfully initialized [Options=Options].

Message #

SRCache successfully initialized [Options=%1]

Fields #

Name	Description
`Options` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StateRepository",
    "guid": "{89592015-D996-4636-8F61-066B5D4DD739}",
    "event_source_name": "",
    "event_id": 269,
    "version": 0,
    "level": 5,
    "task": 2,
    "opcode": 0,
    "keywords": 4611721202799476737,
    "time_created": "2026-05-29T16:33:17.1805848+00:00",
    "event_record_id": 380,
    "correlation": {},
    "execution": {
      "process_id": 3572,
      "thread_id": 3764
    },
    "channel": "Microsoft-Windows-StateRepository/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Options": "0x0"
  },
  "message": "SRCache successfully initialized [Options=0x0]"
}

Event ID 270: Error ErrorCode: SRCache initialization encountered an error [Options=Options].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

Error ErrorCode: SRCache initialization encountered an error [Options=Options].

Message #

Error %1: SRCache initialization encountered an error [Options=%2]

Fields #

Name	Description
`ErrorCode` HexInt32
`Options` HexInt32

Event ID 271: SRCache successfully updated [Options=Options].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Level: Verbose
Task: StateRepository.Task.WinRTAPI

Description

SRCache successfully updated [Options=Options].

Message #

SRCache successfully updated [Options=%1]

Fields #

Name	Description
`Options` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StateRepository",
    "guid": "{89592015-D996-4636-8F61-066B5D4DD739}",
    "event_source_name": "",
    "event_id": 271,
    "version": 0,
    "level": 5,
    "task": 2,
    "opcode": 0,
    "keywords": 4611721202799476737,
    "time_created": "2026-06-13T05:45:51.1407165+00:00",
    "event_record_id": 393,
    "correlation": {
      "ActivityID": "{C6821FB2-EF88-0004-9642-82C688EFDC01}"
    },
    "execution": {
      "process_id": 3572,
      "thread_id": 6416
    },
    "channel": "Microsoft-Windows-StateRepository/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Options": "0x0"
  },
  "message": "SRCache successfully updated [Options=0x0]"
}

Event ID 272: Error ErrorCode: SRCache update encountered an error [Options=Options].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

Error ErrorCode: SRCache update encountered an error [Options=Options].

Message #

Error %1: SRCache update encountered an error [Options=%2]

Fields #

Name	Description
`ErrorCode` HexInt32
`Options` HexInt32

Event ID 273: Check cache integrity has been performed [Options=Options, Disposition=Disposition, ErrorsDetected=ErrorCount].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Check cache integrity has been performed [Options=Options, Disposition=Disposition, ErrorsDetected=ErrorCount].

Message #

Check cache integrity has been performed [Options=%2, Disposition=%3, ErrorsDetected=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Options` HexInt32
`Disposition` Int32
`ErrorCount` UInt64

Event ID 274: Error ErrorCode: Check cache integrity encountered an error [Options=Options, Disposition=Disposition, ErrorsDetected=ErrorCount].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Error ErrorCode: Check cache integrity encountered an error [Options=Options, Disposition=Disposition, ErrorsDetected=ErrorCount].

Message #

Error %1: Check cache integrity encountered an error [Options=%2, Disposition=%3, ErrorsDetected=%4]

Fields #

Name	Description
`ErrorCode` HexInt32
`Options` HexInt32
`Disposition` Int32
`ErrorCount` UInt64

Event ID 275: Count missing cache entries detected for Entity [Ids=Ids].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Count missing cache entries detected for Entity [Ids=Ids].

Message #

%2 missing cache entries detected for %1 [Ids=%3]

Fields #

Name	Description
`Entity` AnsiString
`Count` UInt64
`Ids` AnsiString

Event ID 276: Count unexpected cache entries detected for Entity [Ids=Ids].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Count unexpected cache entries detected for Entity [Ids=Ids].

Message #

%2 unexpected cache entries detected for %1 [Ids=%3]

Fields #

Name	Description
`Entity` AnsiString
`Count` UInt64
`Ids` AnsiString

Event ID 277: Invalid cache entry detected for Entity [Id=Id, Fields=Fields].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.DataAccessLayer

Description

Invalid cache entry detected for Entity [Id=Id, Fields=Fields].

Message #

Invalid cache entry detected for %1 [Id=%2, Fields=%3]

Fields #

Name	Description
`Entity` AnsiString
`Id` UInt64
`Fields` AnsiString

Event ID 278: Waiting for transaction from TransactionCallerId to complete before setting package status.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

Waiting for transaction from TransactionCallerId to complete before setting package status.

Message #

Waiting for transaction from %1 to complete before setting package status.

Fields #

Name	Description
`TransactionCallerId` GUID

Event ID 279: Transaction from TransactionCallerId completed.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

Transaction from TransactionCallerId completed. Proceeding to set package status.

Message #

Transaction from %1 completed. Proceeding to set package status.

Fields #

Name	Description
`TransactionCallerId` GUID

Event ID 280: PackageDependency: Category[Index of Count]: Id=Id, UserSid=UserSID, PackageFullName=PackageFullName, PD.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

PackageDependency: Category[Index of Count]: Id=Id, UserSid=UserSID, PackageFullName=PackageFullName, PD.PrimaryKey=PackageDependencyPrimaryKey, PD.User=PackageDependencyUser, PD.PackageFamilyName=PackageDependencyPackageFamilyName, PD.MinVersion=PackageDependencyMinVersion, PD.Architectures=PackageDependencyArchitectures, PD.LifetimeKind=PackageDependencyLifetimeKind, PD.LifetimeArtifact=PackageDependencyLifetimeArtifact, PD.Flags=PackageDependencyFlags, PD.ProcessId=PackageDependencyProcessId

Message #

PackageDependency: %1[%2 of %3]: Id=%4, UserSid=%5, PackageFullName=%6, PD.PrimaryKey=%7, PD.User=%8, PD.PackageFamilyName=%9, PD.MinVersion=%10, PD.Architectures=%11, PD.LifetimeKind=%12, PD.LifetimeArtifact=%13, PD.Flags=%14, PD.ProcessId=%15

Fields #

Name	Description
`Category` AnsiString
`Index` UInt32
`Count` UInt32
`Id` UnicodeString
`UserSID` UnicodeString
`PackageFullName` UnicodeString
`PackageDependencyPrimaryKey` Int64
`PackageDependencyUser` Int64
`PackageDependencyPackageFamilyName` UnicodeString
`PackageDependencyMinVersion` HexInt64
`PackageDependencyArchitectures` Int32
`PackageDependencyLifetimeKind` Int32
`PackageDependencyLifetimeArtifact` UnicodeString
`PackageDependencyFlags` HexInt32
`PackageDependencyProcessId` UInt32

Event ID 281: PackageDependency Summary: Resolved=ResolvedCount, Transient=TransientCount, Persisted=PersistedCount.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

PackageDependency Summary: Resolved=ResolvedCount, Transient=TransientCount, Persisted=PersistedCount.

Message #

PackageDependency Summary: Resolved=%1, Transient=%2, Persisted=%3

Fields #

Name	Description
`ResolvedCount` UInt32
`TransientCount` UInt32
`PersistedCount` UInt32

Event ID 282: Error ErrorCode: Failed to import package status for user UserSid and package PackageFullName.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

Error ErrorCode: Failed to import package status for user UserSid and package PackageFullName.

Message #

Error %1: Failed to import package status for user %2 and package %3

Fields #

Name	Description
`ErrorCode` HexInt32
`UserSid` UnicodeString
`PackageFullName` UnicodeString

Event ID 283: ImportPackageUserStatus completed with hr=ErrorCode.

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Task: StateRepository.Task.WinRTAPI

Description

ImportPackageUserStatus completed with hr=ErrorCode. Import succeeded for SuccessCount packages and failed for FailureCount packages.

Message #

ImportPackageUserStatus completed with hr=%1. Import succeeded for %2 packages and failed for %3 packages.

Fields #

Name	Description
`ErrorCode` HexInt32
`SuccessCount` UInt64
`FailureCount` UInt64

Event ID 284: REINDEX command has run; database indices are updated [Partition=Partition, ProcessId=ProcessId, Scope=Scope].

Provider: Microsoft-Windows-StateRepository
Channel: Operational
Level: Verbose
Task: StateRepository.Task.WinRTAPI

Description

REINDEX command has run; database indices are updated [Partition=Partition, ProcessId=ProcessId, Scope=Scope].

Message #

REINDEX command has run; database indices are updated [Partition=%1, ProcessId=%2, Scope=%3]

Fields #

Name	Description
`Partition` Int32
`ProcessId` UInt32
`Scope` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StateRepository",
    "event_id": 284,
    "level": 5,
    "task": 2,
    "opcode": 0,
    "time_created": "2026-04-28T01:03:43.2761551+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-StateRepository"
  },
  "event_data": {
    "ProcessId": "3360",
    "Scope": "(database)",
    "Partition": "2"
  }
}

Event ID 1000: [P:ProcessId T:ThreadId] Profile: ElapsedTime msec to run SQL 'SQL'.

Provider: Microsoft-Windows-StateRepository
Channel: Diagnostic
Task: StateRepository.Task.DataAccessLayer

Description

[P:ProcessId T:ThreadId] Profile: ElapsedTime msec to run SQL 'SQL'.

Message #

[P:%3 T:%4] Profile: %1 msec to run SQL '%2'

Fields #

Name	Description
`ElapsedTime` UInt32
`SQL` AnsiString
`ProcessId` UInt32
`ThreadId` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 89592015-d996-4636-8f61-066b5d4dd739

Defined in Windows.StateRepository.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4484, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)