Microsoft-Windows-StickyNotes

69 events across 2 channels

Event	Title	Channel	Sample
1	Opening Sticky Notes Storage	Debug	N
2	Creating Sticky Notes Storage	Debug	N
3	Opening Meta File Storage	Debug	N
4	Creating Sticky Notes Metafile	Debug	N
5	Opening Note	Debug	N
6	Creating New Note	Debug	N
9	Opening Stream	Debug	N
10	Creating Stream	Debug	N
11	Unable to create Ink Data Structure	Debug	N
12	Ink Stream Not Found	Debug	N
13	Error Opening Stream	Debug	N
14	Error Creating Stream	Debug	N
15	Error Deleting Note	Debug	N
17	Error Acquring Write Lock	Debug	N
18	Error Acquring Write Lock	Debug	N
19	Error Renaming File	Debug	N
20	Error Streaming Text From RichEdit	Debug	N
21	Writing To Stream	Debug	N
22	Reading From Stream	Debug	N
23	Unable to Regiter Recovery Fucntion	Debug	N
24	Unable to Load String from Resource	Debug	N
25	Failed to Initialize	Debug	N
26	Failed to Create Object	Debug	N
27	Unable to Initialize Global Variables	Debug	N
30	Unable to Load the Note	Debug	N
31	Unable to Get Note Model	Debug	N
32	Unable to Create Window	Debug	N
38	Error Loading Note Model From Disk for Note	Debug	N
39	Unable to create and load Note Model for Note	Debug	N
40	Unable to retive storage for Note	Debug	N
41	Unable to Delete The Note	Debug	N
43	Error reading Meta Data	Debug	N
46	Failed to Write Meta Data to the File	Debug	N
50	Error enabling/disabling RTS	Debug	N
51	Error setting Ink Reference	Debug	N
54	Opening SNT File	Debug	N
57	Creating URL Accessor	Debug	N
59	BindStream failed	Debug	N
60	Count of Notes =	Debug	N
61	Get Value Failed	Debug	N
62	OpenStream failed	Debug	N
63	Open Title Stream failed	Debug	N
64	Read Title Value Failed	Debug	N
65	Get Path To User Appdata Folder failed	Admin	N
66	AddHierarchicalScope failed	Admin	N
67	AddRoot failed	Admin	N
68	put_FollowDirectories failed	Admin	N
69	put_IsHierarchical failed	Admin	N
70	put_ProvidesNotifications failed	Admin	N
71	put_RootURL failed	Admin	N
72	CoSetProxyBlanket failed	Admin	N
73	CreateSearchRoot failed	Admin	N
92	Failed to Register Search Root and Default Scope	Admin	N
93	Failed to notify Desktop Search to reindex	Admin	N
103	Creating Version File	Debug	N
104	Opening Stream	Debug	N
106	An Erorr occured while saved the NoteModel; Queueing it to save it after some …	Debug	N
107	Failed to save NoteModel from the Save Queue	Debug	N
112	Unexpected Error has occured; Application is going to Quit	Admin	N
120	Meta Data of the Note is corrupt	Admin	N
121	Unable to create parser	Debug	N
122	Upgrade Failed	Admin	N
123	Failed to create ICustomDestinationList interface object	Debug	N
124	Failed Being List Transaction	Debug	N
125	Failed to Create Destination List	Debug	N
126	Unable to create parser	Debug	N
128	Failed to load resource string	Debug	N
129	Unable to set restart key	Debug	N
130	Unable to set restart key	Debug	N

Event ID 1: Opening Sticky Notes Storage

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Opening Sticky Notes Storage.

Message #

Opening Sticky Notes Storage

Event ID 2: Creating Sticky Notes Storage

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Creating Sticky Notes Storage.

Message #

Creating Sticky Notes Storage

Event ID 3: Opening Meta File Storage

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Opening Meta File Storage.

Message #

Opening Meta File Storage

Event ID 4: Creating Sticky Notes Metafile

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Creating Sticky Notes Metafile.

Message #

Creating Sticky Notes Metafile

Event ID 5: Opening Note

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Opening Note.

Message #

Opening Note

Event ID 6: Creating New Note

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Creating New Note.

Message #

Creating New Note

Event ID 9: Opening Stream

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Opening Stream.

Message #

Opening Stream

Event ID 10: Creating Stream

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Creating Stream.

Message #

Creating Stream

Event ID 11: Unable to create Ink Data Structure

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Unable to create Ink Data Structure.

Message #

Unable to create Ink Data Structure

Event ID 12: Ink Stream Not Found

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Ink Stream Not Found.

Message #

Ink Stream Not Found

Event ID 13: Error Opening Stream

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Error Opening Stream.

Message #

Error Opening Stream

Event ID 14: Error Creating Stream

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Error Creating Stream.

Message #

Error Creating Stream

Event ID 15: Error Deleting Note

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Error Deleting Note.

Message #

Error Deleting Note

Event ID 17: Error Acquring Write Lock

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Error Acquring Write Lock.

Message #

Error Acquring Write Lock

Event ID 18: Error Acquring Write Lock

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Error Acquring Write Lock.

Message #

Error Acquring Write Lock

Event ID 19: Error Renaming File

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Error Renaming File.

Message #

Error Renaming File

Event ID 20: Error Streaming Text From RichEdit

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Error Streaming Text From RichEdit.

Message #

Error Streaming Text From RichEdit

Event ID 21: Writing To Stream

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Writing To Stream.

Message #

Writing To Stream

Event ID 22: Reading From Stream

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Reading From Stream.

Message #

Reading From Stream

Event ID 23: Unable to Regiter Recovery Fucntion

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Unable to Regiter Recovery Fucntion.

Message #

Unable to Regiter Recovery Fucntion

Event ID 24: Unable to Load String from Resource

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Unable to Load String from Resource.

Message #

Unable to Load String from Resource

Event ID 25: Failed to Initialize

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Failed to Initialize.

Message #

Failed to Initialize

Event ID 26: Failed to Create Object

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Failed to Create Object.

Message #

Failed to Create Object

Event ID 27: Unable to Initialize Global Variables

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Unable to Initialize Global Variables.

Message #

Unable to Initialize Global Variables

Event ID 30: Unable to Load the Note

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Unable to Load the Note.

Message #

Unable to Load the Note

Event ID 31: Unable to Get Note Model

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Unable to Get Note Model.

Message #

Unable to Get Note Model

Event ID 32: Unable to Create Window

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Unable to Create Window.

Message #

Unable to Create Window

Event ID 38: Error Loading Note Model From Disk for Note

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Error Loading Note Model From Disk for Note.

Message #

Error Loading Note Model From Disk for Note

Event ID 39: Unable to create and load Note Model for Note

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Unable to create and load Note Model for Note.

Message #

Unable to create and load Note Model for Note

Event ID 40: Unable to retive storage for Note

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Unable to retive storage for Note.

Message #

Unable to retive storage for Note

Event ID 41: Unable to Delete The Note

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Unable to Delete The Note.

Message #

Unable to Delete The Note

Event ID 43: Error reading Meta Data

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Error reading Meta Data.

Message #

Error reading Meta Data

Event ID 46: Failed to Write Meta Data to the File

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Failed to Write Meta Data to the File.

Message #

Failed to Write Meta Data to the File

Event ID 50: Error enabling/disabling RTS

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Error enabling/disabling RTS.

Message #

Error enabling/disabling RTS

Event ID 51: Error setting Ink Reference

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Error setting Ink Reference.

Message #

Error setting Ink Reference

Event ID 54: Opening SNT File

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Opening SNT File.

Message #

Opening SNT File

Event ID 57: Creating URL Accessor

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Creating URL Accessor.

Message #

Creating URL Accessor

Event ID 59: BindStream failed

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

BindStream failed.

Message #

BindStream failed

Event ID 60: Count of Notes =

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Count of Notes =.

Message #

Count of Notes =

Event ID 61: Get Value Failed

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Get Value Failed.

Message #

Get Value Failed

Event ID 62: OpenStream failed

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

OpenStream failed.

Message #

OpenStream failed

Event ID 63: Open Title Stream failed

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Open Title Stream failed.

Message #

Open Title Stream failed

Event ID 64: Read Title Value Failed

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Read Title Value Failed.

Message #

Read Title Value Failed

Event ID 65: Get Path To User Appdata Folder failed

Provider: Microsoft-Windows-StickyNotes
Channel: Admin

Description

Get Path To User Appdata Folder failed.

Message #

Get Path To User Appdata Folder failed

Event ID 66: AddHierarchicalScope failed

Provider: Microsoft-Windows-StickyNotes
Channel: Admin

Description

AddHierarchicalScope failed.

Message #

AddHierarchicalScope failed

Event ID 67: AddRoot failed

Provider: Microsoft-Windows-StickyNotes
Channel: Admin

Description

AddRoot failed.

Message #

AddRoot failed

Event ID 68: put_FollowDirectories failed

Provider: Microsoft-Windows-StickyNotes
Channel: Admin

Description

put_FollowDirectories failed.

Message #

put_FollowDirectories failed

Event ID 69: put_IsHierarchical failed

Provider: Microsoft-Windows-StickyNotes
Channel: Admin

Description

put_IsHierarchical failed.

Message #

put_IsHierarchical failed

Event ID 70: put_ProvidesNotifications failed

Provider: Microsoft-Windows-StickyNotes
Channel: Admin

Description

put_ProvidesNotifications failed.

Message #

put_ProvidesNotifications failed

Event ID 71: put_RootURL failed

Provider: Microsoft-Windows-StickyNotes
Channel: Admin

Description

put_RootURL failed.

Message #

put_RootURL failed

Event ID 72: CoSetProxyBlanket failed

Provider: Microsoft-Windows-StickyNotes
Channel: Admin

Description

CoSetProxyBlanket failed.

Message #

CoSetProxyBlanket failed

Event ID 73: CreateSearchRoot failed

Provider: Microsoft-Windows-StickyNotes
Channel: Admin

Description

CreateSearchRoot failed.

Message #

CreateSearchRoot failed

Event ID 92: Failed to Register Search Root and Default Scope

Provider: Microsoft-Windows-StickyNotes
Channel: Admin

Description

Failed to Register Search Root and Default Scope.

Message #

Failed to Register Search Root and Default Scope

Event ID 93: Failed to notify Desktop Search to reindex

Provider: Microsoft-Windows-StickyNotes
Channel: Admin

Description

Failed to notify Desktop Search to reindex.

Message #

Failed to notify Desktop Search to reindex

Event ID 103: Creating Version File

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Creating Version File.

Message #

Creating Version File

Event ID 104: Opening Stream

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Opening Stream.

Message #

Opening Stream

Event ID 106: An Erorr occured while saved the NoteModel; Queueing it to save it after some time

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

An Erorr occured while saved the NoteModel; Queueing it to save it after some time.

Message #

An Erorr occured while saved the NoteModel; Queueing it to save it after some time

Event ID 107: Failed to save NoteModel from the Save Queue

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Failed to save NoteModel from the Save Queue.

Message #

Failed to save NoteModel from the Save Queue

Event ID 112: Unexpected Error has occured; Application is going to Quit

Provider: Microsoft-Windows-StickyNotes
Channel: Admin

Description

Unexpected Error has occured; Application is going to Quit.

Message #

Unexpected Error has occured; Application is going to Quit

Event ID 120: Meta Data of the Note is corrupt

Provider: Microsoft-Windows-StickyNotes
Channel: Admin

Description

Meta Data of the Note is corrupt.

Message #

Meta Data of the Note is corrupt

Event ID 121: Unable to create parser

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Unable to create parser.

Message #

Unable to create parser

Event ID 122: Upgrade Failed

Provider: Microsoft-Windows-StickyNotes
Channel: Admin

Description

Upgrade Failed.

Message #

Upgrade Failed

Event ID 123: Failed to create ICustomDestinationList interface object

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Failed to create ICustomDestinationList interface object.

Message #

Failed to create ICustomDestinationList interface object

Event ID 124: Failed Being List Transaction

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Failed Being List Transaction.

Message #

Failed Being List Transaction

Event ID 125: Failed to Create Destination List

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Failed to Create Destination List.

Message #

Failed to Create Destination List

Event ID 126: Unable to create parser

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Unable to create parser.

Message #

Unable to create parser

Event ID 128: Failed to load resource string

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Failed to load resource string.

Message #

Failed to load resource string

Event ID 129: Unable to set restart key

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Unable to set restart key.

Message #

Unable to set restart key

Event ID 130: Unable to set restart key

Provider: Microsoft-Windows-StickyNotes
Channel: Debug

Description

Unable to set restart key.

Message #

Unable to set restart key

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)