Microsoft-Windows-UIAutomationCore

237 events across 2 channels

Event	Title	Channel	Sample
1	Error_ProviderErrors	Diagnostic	N
2	Error_IAccessibleErrors	Diagnostic	N
3	Error_OtherErrors	Diagnostic	N
4	Error_ClientApiErrors	Diagnostic	N
5	Error_ProcessErrors	Diagnostic	N
101	UIAutomationCoreAPI_UiaClientsAreListeningStart	Perf	N
102	UIAutomationCoreAPI_UiaClientsAreListeningStop	Perf	N
103	UIAutomationCoreAPI_UiaDisconnectAllProvidersStart	Perf	N
104	UIAutomationCoreAPI_UiaDisconnectAllProvidersStop	Perf	N
105	UIAutomationCoreAPI_UiaDisconnectProviderStart	Perf	N
106	UIAutomationCoreAPI_UiaDisconnectProviderStop	Perf	N
107	UIAutomationCoreAPI_UiaGetReservedMixedAttributeValueStart	Perf	N
108	UIAutomationCoreAPI_UiaGetReservedMixedAttributeValueStop	Perf	N
109	UIAutomationCoreAPI_UiaGetReservedNotSupportedValueStart	Perf	N
110	UIAutomationCoreAPI_UiaGetReservedNotSupportedValueStop	Perf	N
111	UIAutomationCoreAPI_UiaHostProviderFromHwndStart	Perf	N
112	UIAutomationCoreAPI_UiaHostProviderFromHwndStop	Perf	N
113	UIAutomationCoreAPI_UiaIAccessibleFromProviderStart	Perf	N
114	UIAutomationCoreAPI_UiaIAccessibleFromProviderStop	Perf	N
115	UIAutomationCoreAPI_UiaProviderForNonClientStart	Perf	N
116	UIAutomationCoreAPI_UiaProviderForNonClientStop	Perf	N
117	UIAutomationCoreAPI_UiaProviderFromIAccessibleStart	Perf	N
118	UIAutomationCoreAPI_UiaProviderFromIAccessibleStop	Perf	N
119	UIAutomationCoreAPI_UiaRaiseEventStart	Perf	N
120	UIAutomationCoreAPI_UiaRaiseEventStop	Perf	N
121	UIAutomationCoreAPI_UiaReturnRawElementProviderStart	Perf	N
122	UIAutomationCoreAPI_UiaReturnRawElementProviderStop	Perf	N
123	UIAutomationProviderApi_UiaReturnCrossMachineConnectionInfoStart	Perf	N
124	UIAutomationProviderApi_UiaReturnCrossMachineConnectionInfoStop	Perf	N
125	UIAutomationCoreAPI_UiaRaiseStructuredMarkupEventStart	Perf	N
126	UIAutomationCoreAPI_UiaRaiseStructuredMarkupEventStop	Perf	N
201	CUIAutomation_AddEventHandlerStart	Perf	N
202	CUIAutomation_AddEventHandlerStop	Perf	N
203	CUIAutomation_CompareElementsStart	Perf	N
204	CUIAutomation_CompareElementsStop	Perf	N
205	CUIAutomation_CompareRuntimeIdsStart	Perf	N
206	CUIAutomation_CompareRuntimeIdsStop	Perf	N
207	CUIAutomation_CreateConditionStart	Perf	N
208	CUIAutomation_CreateConditionStop	Perf	N
209	CUIAutomation_CreateCacheRequestStart	Perf	N
210	CUIAutomation_CreateCacheRequestStop	Perf	N
211	CUIAutomation_CreateProxyFactoryEntryStart	Perf	N
212	CUIAutomation_CreateProxyFactoryEntryStop	Perf	N
213	CUIAutomation_CreateTreeWalkerStart	Perf	N
214	CUIAutomation_CreateTreeWalkerStop	Perf	N
215	CUIAutomation_ElementFromHandleStart	Perf	N
216	CUIAutomation_ElementFromHandleStop	Perf	N
217	CUIAutomation_ElementFromHandleBuildCacheStart	Perf	N
218	CUIAutomation_ElementFromHandleBuildCacheStop	Perf	N
219	CUIAutomation_ElementFromIAccessibleStart	Perf	N
220	CUIAutomation_ElementFromIAccessibleStop	Perf	N
221	CUIAutomation_ElementFromIAccessibleBuildCacheStart	Perf	N
222	CUIAutomation_ElementFromIAccessibleBuildCacheStop	Perf	N
223	CUIAutomation_ElementFromPointStart	Perf	N
224	CUIAutomation_ElementFromPointStop	Perf	N
225	CUIAutomation_ElementFromPointBuildCacheStart	Perf	N
226	CUIAutomation_ElementFromPointBuildCacheStop	Perf	N
227	CUIAutomation_GetFocusedElementStart	Perf	N
228	CUIAutomation_GetFocusedElementStop	Perf	N
229	CUIAutomation_GetFocusedElementBuildCacheStart	Perf	N
230	CUIAutomation_GetFocusedElementBuildCacheStop	Perf	N
231	CUIAutomation_GetPatternProgrammaticNameStart	Perf	N
232	CUIAutomation_GetPatternProgrammaticNameStop	Perf	N
233	CUIAutomation_GetPropertyProgrammaticNameStart	Perf	N
234	CUIAutomation_GetPropertyProgrammaticNameStop	Perf	N
235	CUIAutomation_GetRootElementStart	Perf	N
236	CUIAutomation_GetRootElementStop	Perf	N
237	CUIAutomation_GetRootElementBuildCacheStart	Perf	N
238	CUIAutomation_GetRootElementBuildCacheStop	Perf	N
239	CUIAutomation_PollForPotentialSupportedPatternsStart	Perf	N
240	CUIAutomation_PollForPotentialSupportedPatternsStop	Perf	N
241	CUIAutomation_PollForPotentialSupportedPropertiesStart	Perf	N
242	CUIAutomation_PollForPotentialSupportedPropertiesStop	Perf	N
243	CUIAutomation_RemoveEventHandlerStart	Perf	N
244	CUIAutomation_RemoveEventHandlerStop	Perf	N
245	CUIAutomation_CreateEventHandlerGroupStart	Perf	N
246	CUIAutomation_CreateEventHandlerGroupStop	Perf	N
247	CUIAutomation_AddEventHandlerGroupStart	Perf	N
248	CUIAutomation_AddEventHandlerGroupStop	Perf	N
249	CUIAutomation_RemoveEventHandlerGroupStart	Perf	N
250	CUIAutomation_RemoveEventHandlerGroupStop	Perf	N
251	CUIAutomation_AddStructuredMarkupEventHandlerStart	Perf	N
252	CUIAutomation_AddStructuredMarkupEventHandlerStop	Perf	N
253	CUIAutomation_RemoveStructuredMarkupEventHandlerStart	Perf	N
254	CUIAutomation_RemoveStructuredMarkupEventHandlerStop	Perf	N
301	CAutomationElement_BuildUpdatedCacheStart	Perf	N
302	CAutomationElement_BuildUpdatedCacheStop	Perf	N
303	CAutomationElement_FindAllStart	Perf	N
304	CAutomationElement_FindAllStop	Perf	N
305	CAutomationElement_FindAllBuildCacheStart	Perf	N
306	CAutomationElement_FindAllBuildCacheStop	Perf	N
307	CAutomationElement_FindFirstStart	Perf	N
308	CAutomationElement_FindFirstStop	Perf	N
309	CAutomationElement_FindFirstBuildCacheStart	Perf	N
310	CAutomationElement_FindFirstBuildCacheStop	Perf	N
311	CAutomationElement_GetCachedChildrenStart	Perf	N
312	CAutomationElement_GetCachedChildrenStop	Perf	N
313	CAutomationElement_GetCachedParentStart	Perf	N
314	CAutomationElement_GetCachedParentStop	Perf	N
315	CAutomationElement_GetCachedPatternStart	Perf	N
316	CAutomationElement_GetCachedPatternStop	Perf	N
317	CAutomationElement_GetCachedPatternAsStart	Perf	N
318	CAutomationElement_GetCachedPatternAsStop	Perf	N
319	CAutomationElement_GetCachedPropertyValueStart	Perf	N
320	CAutomationElement_GetCachedPropertyValueStop	Perf	N
321	CAutomationElement_GetCachedPropertyValueExStart	Perf	N
322	CAutomationElement_GetCachedPropertyValueExStop	Perf	N
323	CAutomationElement_GetClickablePointStart	Perf	N
324	CAutomationElement_GetClickablePointStop	Perf	N
325	CAutomationElement_GetCurrentPatternStart	Perf	N
326	CAutomationElement_GetCurrentPatternStop	Perf	N
327	CAutomationElement_GetCurrentPatternAsStart	Perf	N
328	CAutomationElement_GetCurrentPatternAsStop	Perf	N
329	CAutomationElement_GetCurrentPropertyValueStart	Perf	N
330	CAutomationElement_GetCurrentPropertyValueStop	Perf	N
331	CAutomationElement_GetCurrentPropertyValueExStart	Perf	N
332	CAutomationElement_GetCurrentPropertyValueExStop	Perf	N
333	CAutomationElement_GetRuntimeIdStart	Perf	N
334	CAutomationElement_GetRuntimeIdStop	Perf	N
335	CAutomationElement_SetFocusStart	Perf	N
336	CAutomationElement_SetFocusStop	Perf	N
337	CAutomationElement_ShowContextMenuStart	Perf	N
338	CAutomationElement_ShowContextMenuStop	Perf	N
339	CAutomationElement_FindAllWithOptionsStart	Perf	N
340	CAutomationElement_FindAllWithOptionsStop	Perf	N
341	CAutomationElement_FindAllWithOptionsBuildCacheStart	Perf	N
342	CAutomationElement_FindAllWithOptionsBuildCacheStop	Perf	N
343	CAutomationElement_FindFirstWithOptionsStart	Perf	N
344	CAutomationElement_FindFirstWithOptionsStop	Perf	N
345	CAutomationElement_FindFirstWithOptionsBuildCacheStart	Perf	N
346	CAutomationElement_FindFirstWithOptionsBuildCacheStop	Perf	N
403	CTextRange_CloneStart	Perf	N
404	CTextRange_CloneStop	Perf	N
405	CTextRange_CompareStart	Perf	N
406	CTextRange_CompareStop	Perf	N
407	CTextRange_CompareEndpointsStart	Perf	N
408	CTextRange_CompareEndpointsStop	Perf	N
409	CTextRange_ExpandToEnclosingUnitStart	Perf	N
410	CTextRange_ExpandToEnclosingUnitStop	Perf	N
411	CTextRange_GetAttributeValueStart	Perf	N
412	CTextRange_GetAttributeValueStop	Perf	N
413	CTextRange_GetEnclosingElementStart	Perf	N
414	CTextRange_GetEnclosingElementStop	Perf	N
415	CTextRange_GetTextStart	Perf	N
416	CTextRange_GetTextStop	Perf	N
417	CTextRange_MoveStart	Perf	N
418	CTextRange_MoveStop	Perf	N
419	CTextRange_MoveEndpointByUnitStart	Perf	N
420	CTextRange_MoveEndpointByUnitStop	Perf	N
421	CTextRange_MoveEndpointByRangeStart	Perf	N
422	CTextRange_MoveEndpointByRangeStop	Perf	N
423	CTextRange_GetChildrenStart	Perf	N
424	CTextRange_GetChildrenStop	Perf	N
501	CTreeWalker_NavigateStart	Perf	N
502	CTreeWalker_NavigateStop	Perf	N
503	RichEditProxy_GetTextStart	Perf	N
504	RichEditProxy_GetTextStop	Perf	N
505	RichEditProxy_GetVisibleRangeStart	Perf	N
506	RichEditProxy_GetVisibleRangeStop	Perf	N
507	EditProxy_NextWordStart	Perf	N
508	EditProxy_NextWordStop	Perf	N
509	ClientConnection_CallWithReturnStart	Perf	N
510	ClientConnection_CallWithReturnStop	Perf	N
511	CSelectionPattern_GetCurrentSelectionStart	Perf	N
512	CSelectionPattern_GetCurrentSelectionStop	Perf	N
513	HandleWinEventStart	Perf	N
514	HandleWinEventStop	Perf	N
515	CoalesceWinEvent	Perf	N
517	UiaProviderCalloutStart	Perf	N
518	UiaProviderCalloutStop	Perf	N
519	MsaaProviderCalloutStart	Perf	N
520	MsaaProviderCalloutStop	Perf	N
521	ClientConnection_DispatchToProviderStart	Perf	N
522	ClientConnection_DispatchToProviderStop	Perf	N
523	ProcessIncomingRequestStart	Perf	N
524	ProcessIncomingRequestStop	Perf	N
525	ProcessIncomingRequest_ContextChangeStart	Perf	N
526	ProcessIncomingRequest_ContextChangeStop	Perf	N
527	ServerConnection_OnData_ForceFlush	Perf	N
528	ReleaseCollection_ObjectNotFound	Perf	N
529	ReleaseCollection_ReleaseObjects	Perf	N
530	ReleaseCollection_IncompatibleContext	Perf	N
531	ClientConnection_StateChange	Perf	N
532	IsProcessFrozenCheckStart	Perf	N
533	IsProcessFrozenCheckStop	Perf	N
534	ClientConnection_InactiveRequestResponse	Perf	N
535	ClientConnection_ConnectionTerminated	Perf	N
536	EventManager_DoCalldowns_UniversalStart	Perf	N
537	EventManager_DoCalldowns_UniversalStop	Perf	N
538	EventManager_DoCalldowns_ClientSideOptimizedStart	Perf	N
539	EventManager_DoCalldowns_ClientSideOptimizedStop	Perf	N
540	EventManager_CollectNodesToAdviseStart	Perf	N
541	EventManager_CollectNodesToAdviseStop	Perf	N
542	EventManager_CollectClientSideItemsToAdviseStart	Perf	N
543	EventManager_CollectClientSideItemsToAdviseStop	Perf	N
544	ClientConnection_RequestWritten	Perf	N
545	ServerConnection_RequestReceived	Perf	N
546	ServerConnection_ResponseWritten	Perf	N
547	ClientConnection_ResponseReceived	Perf	N
603	IA2TextRange_CloneStart	Perf	N
604	IA2TextRange_CloneStop	Perf	N
605	IA2TextRange_CompareStart	Perf	N
606	IA2TextRange_CompareStop	Perf	N
607	IA2TextRange_CompareEndpointsStart	Perf	N
608	IA2TextRange_CompareEndpointsStop	Perf	N
609	IA2TextRange_ExpandToEnclosingUnitStart	Perf	N
610	IA2TextRange_ExpandToEnclosingUnitStop	Perf	N
611	IA2TextRange_GetAttributeValueStart	Perf	N
612	IA2TextRange_GetAttributeValueStop	Perf	N
613	IA2TextRange_GetEnclosingElementStart	Perf	N
614	IA2TextRange_GetEnclosingElementStop	Perf	N
615	IA2TextRange_GetTextStart	Perf	N
616	IA2TextRange_GetTextStop	Perf	N
617	IA2TextRange_MoveStart	Perf	N
618	IA2TextRange_MoveStop	Perf	N
619	IA2TextRange_MoveEndpointByUnitStart	Perf	N
620	IA2TextRange_MoveEndpointByUnitStop	Perf	N
621	IA2TextRange_MoveEndpointByRangeStart	Perf	N
622	IA2TextRange_MoveEndpointByRangeStop	Perf	N
623	IA2TextRange_GetChildrenStart	Perf	N
624	IA2TextRange_GetChildrenStop	Perf	N
625	IA2TextRange_FindAttributeStart	Perf	N
626	IA2TextRange_FindAttributeStop	Perf	N
627	IA2TextRange_FindTextStart	Perf	N
628	IA2TextRange_FindTextStop	Perf	N
629	IA2TextRange_GetBoundingRectanglesStart	Perf	N
630	IA2TextRange_GetBoundingRectanglesStop	Perf	N
631	IA2TextRange_SelectStart	Perf	N
632	IA2TextRange_SelectStop	Perf	N
633	IA2TextRange_AddToSelectionStart	Perf	N
634	IA2TextRange_AddToSelectionStop	Perf	N
635	IA2TextRange_RemoveFromSelectionStart	Perf	N
636	IA2TextRange_RemoveFromSelectionStop	Perf	N
637	IA2TextRange_ScrollIntoViewStart	Perf	N
638	IA2TextRange_ScrollIntoViewStop	Perf	N
701	ClientConnectionTimeout	Perf	N
702	EventOverflow	Perf	N

Event ID 1: Error_ProviderErrors

Provider: Microsoft-Windows-UIAutomationCore
Channel: Diagnostic
Task: Error_ProviderErrors

Fields #

Name	Description
`Method` UnicodeString
`Hresult` HexInt32
`Details` UnicodeString
`SourceHwnd` UnicodeString
`Provider` UnicodeString

Event ID 2: Error_IAccessibleErrors

Provider: Microsoft-Windows-UIAutomationCore
Channel: Diagnostic
Task: Error_IAccessibleErrors

Fields #

Name	Description
`Method` UnicodeString
`Hresult` HexInt32
`Details` UnicodeString
`SourceHwnd` UnicodeString
`Provider` UnicodeString

Event ID 3: Error_OtherErrors

Provider: Microsoft-Windows-UIAutomationCore
Channel: Diagnostic
Task: Error_OtherErrors

Fields #

Name	Description
`Method` UnicodeString
`ErrorCode` UInt32
`Details` UnicodeString

Event ID 4: Error_ClientApiErrors

Provider: Microsoft-Windows-UIAutomationCore
Channel: Diagnostic
Task: Error_ClientApiErrors

Fields #

Name	Description
`Method` UnicodeString
`Parameter` UnicodeString
`Details` UnicodeString

Event ID 5: Error_ProcessErrors

Provider: Microsoft-Windows-UIAutomationCore
Channel: Diagnostic
Task: Error_ProcessErrors

Fields #

Name	Description
`Method` UnicodeString
`Win32Error` UInt32
`HRESULT` HexInt32
`ProcessId` UInt32
`Details` UnicodeString

Event ID 101: UIAutomationCoreAPI_UiaClientsAreListeningStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaClientsAreListening
Opcode: Start

Event ID 102: UIAutomationCoreAPI_UiaClientsAreListeningStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaClientsAreListening
Opcode: Stop

Event ID 103: UIAutomationCoreAPI_UiaDisconnectAllProvidersStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaDisconnectAllProviders
Opcode: Start

Event ID 104: UIAutomationCoreAPI_UiaDisconnectAllProvidersStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaDisconnectAllProviders
Opcode: Stop

Event ID 105: UIAutomationCoreAPI_UiaDisconnectProviderStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaDisconnectProvider
Opcode: Start

Event ID 106: UIAutomationCoreAPI_UiaDisconnectProviderStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaDisconnectProvider
Opcode: Stop

Event ID 107: UIAutomationCoreAPI_UiaGetReservedMixedAttributeValueStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaGetReservedMixedAttributeValue
Opcode: Start

Event ID 108: UIAutomationCoreAPI_UiaGetReservedMixedAttributeValueStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaGetReservedMixedAttributeValue
Opcode: Stop

Event ID 109: UIAutomationCoreAPI_UiaGetReservedNotSupportedValueStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaGetReservedNotSupportedValue
Opcode: Start

Event ID 110: UIAutomationCoreAPI_UiaGetReservedNotSupportedValueStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaGetReservedNotSupportedValue
Opcode: Stop

Event ID 111: UIAutomationCoreAPI_UiaHostProviderFromHwndStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaHostProviderFromHwnd
Opcode: Start

Event ID 112: UIAutomationCoreAPI_UiaHostProviderFromHwndStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaHostProviderFromHwnd
Opcode: Stop

Event ID 113: UIAutomationCoreAPI_UiaIAccessibleFromProviderStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaIAccessibleFromProvider
Opcode: Start

Event ID 114: UIAutomationCoreAPI_UiaIAccessibleFromProviderStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaIAccessibleFromProvider
Opcode: Stop

Event ID 115: UIAutomationCoreAPI_UiaProviderForNonClientStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaProviderForNonClient
Opcode: Start

Event ID 116: UIAutomationCoreAPI_UiaProviderForNonClientStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaProviderForNonClient
Opcode: Stop

Event ID 117: UIAutomationCoreAPI_UiaProviderFromIAccessibleStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaProviderFromIAccessible
Opcode: Start

Event ID 118: UIAutomationCoreAPI_UiaProviderFromIAccessibleStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaProviderFromIAccessible
Opcode: Stop

Event ID 119: UIAutomationCoreAPI_UiaRaiseEventStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaRaiseEvent
Opcode: Start

Event ID 120: UIAutomationCoreAPI_UiaRaiseEventStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaRaiseEvent
Opcode: Stop

Event ID 121: UIAutomationCoreAPI_UiaReturnRawElementProviderStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaReturnRawElementProvider
Opcode: Start

Event ID 122: UIAutomationCoreAPI_UiaReturnRawElementProviderStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaReturnRawElementProvider
Opcode: Stop

Event ID 123: UIAutomationProviderApi_UiaReturnCrossMachineConnectionInfoStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationProviderApi_UiaReturnCrossMachineConnectionInfo
Opcode: Start

Event ID 124: UIAutomationProviderApi_UiaReturnCrossMachineConnectionInfoStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationProviderApi_UiaReturnCrossMachineConnectionInfo
Opcode: Stop

Event ID 125: UIAutomationCoreAPI_UiaRaiseStructuredMarkupEventStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaRaiseStructuredMarkupEvent
Opcode: Start

Event ID 126: UIAutomationCoreAPI_UiaRaiseStructuredMarkupEventStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UIAutomationCoreAPI_UiaRaiseStructuredMarkupEvent
Opcode: Stop

Event ID 201: CUIAutomation_AddEventHandlerStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_AddEventHandler
Opcode: Start

Event ID 202: CUIAutomation_AddEventHandlerStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_AddEventHandler
Opcode: Stop

Event ID 203: CUIAutomation_CompareElementsStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_CompareElements
Opcode: Start

Event ID 204: CUIAutomation_CompareElementsStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_CompareElements
Opcode: Stop

Event ID 205: CUIAutomation_CompareRuntimeIdsStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_CompareRuntimeIds
Opcode: Start

Event ID 206: CUIAutomation_CompareRuntimeIdsStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_CompareRuntimeIds
Opcode: Stop

Event ID 207: CUIAutomation_CreateConditionStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_CreateCondition
Opcode: Start

Event ID 208: CUIAutomation_CreateConditionStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_CreateCondition
Opcode: Stop

Event ID 209: CUIAutomation_CreateCacheRequestStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_CreateCacheRequest
Opcode: Start

Event ID 210: CUIAutomation_CreateCacheRequestStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_CreateCacheRequest
Opcode: Stop

Event ID 211: CUIAutomation_CreateProxyFactoryEntryStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_CreateProxyFactoryEntry
Opcode: Start

Event ID 212: CUIAutomation_CreateProxyFactoryEntryStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_CreateProxyFactoryEntry
Opcode: Stop

Event ID 213: CUIAutomation_CreateTreeWalkerStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_CreateTreeWalker
Opcode: Start

Event ID 214: CUIAutomation_CreateTreeWalkerStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_CreateTreeWalker
Opcode: Stop

Event ID 215: CUIAutomation_ElementFromHandleStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_ElementFromHandle
Opcode: Start

Event ID 216: CUIAutomation_ElementFromHandleStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_ElementFromHandle
Opcode: Stop

Event ID 217: CUIAutomation_ElementFromHandleBuildCacheStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_ElementFromHandleBuildCache
Opcode: Start

Event ID 218: CUIAutomation_ElementFromHandleBuildCacheStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_ElementFromHandleBuildCache
Opcode: Stop

Event ID 219: CUIAutomation_ElementFromIAccessibleStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_ElementFromIAccessible
Opcode: Start

Event ID 220: CUIAutomation_ElementFromIAccessibleStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_ElementFromIAccessible
Opcode: Stop

Event ID 221: CUIAutomation_ElementFromIAccessibleBuildCacheStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_ElementFromIAccessibleBuildCache
Opcode: Start

Event ID 222: CUIAutomation_ElementFromIAccessibleBuildCacheStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_ElementFromIAccessibleBuildCache
Opcode: Stop

Event ID 223: CUIAutomation_ElementFromPointStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_ElementFromPoint
Opcode: Start

Event ID 224: CUIAutomation_ElementFromPointStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_ElementFromPoint
Opcode: Stop

Event ID 225: CUIAutomation_ElementFromPointBuildCacheStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_ElementFromPointBuildCache
Opcode: Start

Event ID 226: CUIAutomation_ElementFromPointBuildCacheStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_ElementFromPointBuildCache
Opcode: Stop

Event ID 227: CUIAutomation_GetFocusedElementStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_GetFocusedElement
Opcode: Start

Event ID 228: CUIAutomation_GetFocusedElementStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_GetFocusedElement
Opcode: Stop

Event ID 229: CUIAutomation_GetFocusedElementBuildCacheStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_GetFocusedElementBuildCache
Opcode: Start

Event ID 230: CUIAutomation_GetFocusedElementBuildCacheStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_GetFocusedElementBuildCache
Opcode: Stop

Event ID 231: CUIAutomation_GetPatternProgrammaticNameStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_GetPatternProgrammaticName
Opcode: Start

Event ID 232: CUIAutomation_GetPatternProgrammaticNameStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_GetPatternProgrammaticName
Opcode: Stop

Event ID 233: CUIAutomation_GetPropertyProgrammaticNameStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_GetPropertyProgrammaticName
Opcode: Start

Event ID 234: CUIAutomation_GetPropertyProgrammaticNameStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_GetPropertyProgrammaticName
Opcode: Stop

Event ID 235: CUIAutomation_GetRootElementStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_GetRootElement
Opcode: Start

Event ID 236: CUIAutomation_GetRootElementStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_GetRootElement
Opcode: Stop

Event ID 237: CUIAutomation_GetRootElementBuildCacheStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_GetRootElementBuildCache
Opcode: Start

Event ID 238: CUIAutomation_GetRootElementBuildCacheStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_GetRootElementBuildCache
Opcode: Stop

Event ID 239: CUIAutomation_PollForPotentialSupportedPatternsStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_PollForPotentialSupportedPatterns
Opcode: Start

Event ID 240: CUIAutomation_PollForPotentialSupportedPatternsStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_PollForPotentialSupportedPatterns
Opcode: Stop

Event ID 241: CUIAutomation_PollForPotentialSupportedPropertiesStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_PollForPotentialSupportedProperties
Opcode: Start

Event ID 242: CUIAutomation_PollForPotentialSupportedPropertiesStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_PollForPotentialSupportedProperties
Opcode: Stop

Event ID 243: CUIAutomation_RemoveEventHandlerStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_RemoveEventHandler
Opcode: Start

Event ID 244: CUIAutomation_RemoveEventHandlerStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_RemoveEventHandler
Opcode: Stop

Event ID 245: CUIAutomation_CreateEventHandlerGroupStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_CreateEventHandlerGroup
Opcode: Start

Event ID 246: CUIAutomation_CreateEventHandlerGroupStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_CreateEventHandlerGroup
Opcode: Stop

Event ID 247: CUIAutomation_AddEventHandlerGroupStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_AddEventHandlerGroup
Opcode: Start

Event ID 248: CUIAutomation_AddEventHandlerGroupStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_AddEventHandlerGroup
Opcode: Stop

Event ID 249: CUIAutomation_RemoveEventHandlerGroupStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_RemoveEventHandlerGroup
Opcode: Start

Event ID 250: CUIAutomation_RemoveEventHandlerGroupStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_RemoveEventHandlerGroup
Opcode: Stop

Event ID 251: CUIAutomation_AddStructuredMarkupEventHandlerStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_AddStructuredMarkupEventHandler
Opcode: Start

Event ID 252: CUIAutomation_AddStructuredMarkupEventHandlerStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_AddStructuredMarkupEventHandler
Opcode: Stop

Event ID 253: CUIAutomation_RemoveStructuredMarkupEventHandlerStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_RemoveStructuredMarkupEventHandler
Opcode: Start

Event ID 254: CUIAutomation_RemoveStructuredMarkupEventHandlerStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CUIAutomation_RemoveStructuredMarkupEventHandler
Opcode: Stop

Event ID 301: CAutomationElement_BuildUpdatedCacheStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_BuildUpdatedCache
Opcode: Start

Event ID 302: CAutomationElement_BuildUpdatedCacheStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_BuildUpdatedCache
Opcode: Stop

Event ID 303: CAutomationElement_FindAllStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_FindAll
Opcode: Start

Event ID 304: CAutomationElement_FindAllStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_FindAll
Opcode: Stop

Event ID 305: CAutomationElement_FindAllBuildCacheStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_FindAllBuildCache
Opcode: Start

Event ID 306: CAutomationElement_FindAllBuildCacheStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_FindAllBuildCache
Opcode: Stop

Event ID 307: CAutomationElement_FindFirstStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_FindFirst
Opcode: Start

Event ID 308: CAutomationElement_FindFirstStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_FindFirst
Opcode: Stop

Event ID 309: CAutomationElement_FindFirstBuildCacheStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_FindFirstBuildCache
Opcode: Start

Event ID 310: CAutomationElement_FindFirstBuildCacheStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_FindFirstBuildCache
Opcode: Stop

Event ID 311: CAutomationElement_GetCachedChildrenStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCachedChildren
Opcode: Start

Event ID 312: CAutomationElement_GetCachedChildrenStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCachedChildren
Opcode: Stop

Event ID 313: CAutomationElement_GetCachedParentStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCachedParent
Opcode: Start

Event ID 314: CAutomationElement_GetCachedParentStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCachedParent
Opcode: Stop

Event ID 315: CAutomationElement_GetCachedPatternStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCachedPattern
Opcode: Start

Event ID 316: CAutomationElement_GetCachedPatternStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCachedPattern
Opcode: Stop

Event ID 317: CAutomationElement_GetCachedPatternAsStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCachedPatternAs
Opcode: Start

Event ID 318: CAutomationElement_GetCachedPatternAsStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCachedPatternAs
Opcode: Stop

Event ID 319: CAutomationElement_GetCachedPropertyValueStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCachedPropertyValue
Opcode: Start

Event ID 320: CAutomationElement_GetCachedPropertyValueStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCachedPropertyValue
Opcode: Stop

Event ID 321: CAutomationElement_GetCachedPropertyValueExStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCachedPropertyValueEx
Opcode: Start

Event ID 322: CAutomationElement_GetCachedPropertyValueExStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCachedPropertyValueEx
Opcode: Stop

Event ID 323: CAutomationElement_GetClickablePointStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetClickablePoint
Opcode: Start

Event ID 324: CAutomationElement_GetClickablePointStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetClickablePoint
Opcode: Stop

Event ID 325: CAutomationElement_GetCurrentPatternStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCurrentPattern
Opcode: Start

Event ID 326: CAutomationElement_GetCurrentPatternStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCurrentPattern
Opcode: Stop

Event ID 327: CAutomationElement_GetCurrentPatternAsStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCurrentPatternAs
Opcode: Start

Event ID 328: CAutomationElement_GetCurrentPatternAsStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCurrentPatternAs
Opcode: Stop

Event ID 329: CAutomationElement_GetCurrentPropertyValueStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCurrentPropertyValue
Opcode: Start

Event ID 330: CAutomationElement_GetCurrentPropertyValueStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCurrentPropertyValue
Opcode: Stop

Event ID 331: CAutomationElement_GetCurrentPropertyValueExStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCurrentPropertyValueEx
Opcode: Start

Event ID 332: CAutomationElement_GetCurrentPropertyValueExStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetCurrentPropertyValueEx
Opcode: Stop

Event ID 333: CAutomationElement_GetRuntimeIdStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetRuntimeId
Opcode: Start

Event ID 334: CAutomationElement_GetRuntimeIdStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_GetRuntimeId
Opcode: Stop

Event ID 335: CAutomationElement_SetFocusStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_SetFocus
Opcode: Start

Event ID 336: CAutomationElement_SetFocusStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_SetFocus
Opcode: Stop

Event ID 337: CAutomationElement_ShowContextMenuStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_ShowContextMenu
Opcode: Start

Event ID 338: CAutomationElement_ShowContextMenuStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_ShowContextMenu
Opcode: Stop

Event ID 339: CAutomationElement_FindAllWithOptionsStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_FindAllWithOptions
Opcode: Start

Event ID 340: CAutomationElement_FindAllWithOptionsStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_FindAllWithOptions
Opcode: Stop

Event ID 341: CAutomationElement_FindAllWithOptionsBuildCacheStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_FindAllWithOptionsBuildCache
Opcode: Start

Event ID 342: CAutomationElement_FindAllWithOptionsBuildCacheStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_FindAllWithOptionsBuildCache
Opcode: Stop

Event ID 343: CAutomationElement_FindFirstWithOptionsStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_FindFirstWithOptions
Opcode: Start

Event ID 344: CAutomationElement_FindFirstWithOptionsStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_FindFirstWithOptions
Opcode: Stop

Event ID 345: CAutomationElement_FindFirstWithOptionsBuildCacheStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_FindFirstWithOptionsBuildCache
Opcode: Start

Event ID 346: CAutomationElement_FindFirstWithOptionsBuildCacheStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CAutomationElement_FindFirstWithOptionsBuildCache
Opcode: Stop

Event ID 403: CTextRange_CloneStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_Clone
Opcode: Start

Event ID 404: CTextRange_CloneStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_Clone
Opcode: Stop

Event ID 405: CTextRange_CompareStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_Compare
Opcode: Start

Event ID 406: CTextRange_CompareStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_Compare
Opcode: Stop

Event ID 407: CTextRange_CompareEndpointsStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_CompareEndpoints
Opcode: Start

Event ID 408: CTextRange_CompareEndpointsStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_CompareEndpoints
Opcode: Stop

Event ID 409: CTextRange_ExpandToEnclosingUnitStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_ExpandToEnclosingUnit
Opcode: Start

Event ID 410: CTextRange_ExpandToEnclosingUnitStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_ExpandToEnclosingUnit
Opcode: Stop

Event ID 411: CTextRange_GetAttributeValueStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_GetAttributeValue
Opcode: Start

Event ID 412: CTextRange_GetAttributeValueStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_GetAttributeValue
Opcode: Stop

Event ID 413: CTextRange_GetEnclosingElementStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_GetEnclosingElement
Opcode: Start

Event ID 414: CTextRange_GetEnclosingElementStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_GetEnclosingElement
Opcode: Stop

Event ID 415: CTextRange_GetTextStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_GetText
Opcode: Start

Event ID 416: CTextRange_GetTextStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_GetText
Opcode: Stop

Event ID 417: CTextRange_MoveStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_Move
Opcode: Start

Event ID 418: CTextRange_MoveStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_Move
Opcode: Stop

Event ID 419: CTextRange_MoveEndpointByUnitStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_MoveEndpointByUnit
Opcode: Start

Event ID 420: CTextRange_MoveEndpointByUnitStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_MoveEndpointByUnit
Opcode: Stop

Event ID 421: CTextRange_MoveEndpointByRangeStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_MoveEndpointByRange
Opcode: Start

Event ID 422: CTextRange_MoveEndpointByRangeStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_MoveEndpointByRange
Opcode: Stop

Event ID 423: CTextRange_GetChildrenStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_GetChildren
Opcode: Start

Event ID 424: CTextRange_GetChildrenStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTextRange_GetChildren
Opcode: Stop

Event ID 501: CTreeWalker_NavigateStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTreeWalker_Navigate
Opcode: Start

Event ID 502: CTreeWalker_NavigateStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CTreeWalker_Navigate
Opcode: Stop

Event ID 503: RichEditProxy_GetTextStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: RichEditProxy_GetText
Opcode: Start

Event ID 504: RichEditProxy_GetTextStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: RichEditProxy_GetText
Opcode: Stop

Event ID 505: RichEditProxy_GetVisibleRangeStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: RichEditProxy_GetVisibleRange
Opcode: Start

Event ID 506: RichEditProxy_GetVisibleRangeStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: RichEditProxy_GetVisibleRange
Opcode: Stop

Event ID 507: EditProxy_NextWordStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: EditProxy_NextWord
Opcode: Start

Event ID 508: EditProxy_NextWordStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: EditProxy_NextWord
Opcode: Stop

Event ID 509: ClientConnection_CallWithReturnStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ClientConnection_CallWithReturn
Opcode: Start

Fields #

Name	Description
`MethodName` UnicodeString
`IsCrossMachine` Boolean
`ProcessId` UInt32
`ObjectReference` UInt32
`Duration` UInt64
`RequestId` UInt32

Event ID 510: ClientConnection_CallWithReturnStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ClientConnection_CallWithReturn
Opcode: Stop

Fields #

Name	Description
`MethodName` UnicodeString
`IsCrossMachine` Boolean
`ProcessId` UInt32
`ObjectReference` UInt32
`Duration` UInt64
`RequestId` UInt32

Event ID 511: CSelectionPattern_GetCurrentSelectionStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CSelectionPattern_GetCurrentSelection
Opcode: Start

Event ID 512: CSelectionPattern_GetCurrentSelectionStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CSelectionPattern_GetCurrentSelection
Opcode: Stop

Event ID 513: HandleWinEventStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: HandleWinEvent
Opcode: Start

Fields #

Name	Description
`Method` UnicodeString
`HWND` HexInt32
`WindowClassName` UnicodeString
`EventId` HexInt32
`ObjectId` HexInt32
`ChildId` UInt32

Event ID 514: HandleWinEventStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: HandleWinEvent
Opcode: Stop

Fields #

Name	Description
`Method` UnicodeString
`HWND` HexInt32
`WindowClassName` UnicodeString
`EventId` HexInt32
`ObjectId` HexInt32
`ChildId` UInt32

Event ID 515: CoalesceWinEvent

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: CoalesceWinEvent

Fields #

Name	Description
`Method` UnicodeString
`HWND` HexInt32
`WindowClassName` UnicodeString
`EventId` HexInt32
`CoalescedEvents` UInt32

Event ID 517: UiaProviderCalloutStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UiaProviderCallout
Opcode: Start

Fields #

Name	Description
`MethodName` UnicodeString
`Parameter1` UInt32
`Parameter2` UInt32

Event ID 518: UiaProviderCalloutStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: UiaProviderCallout
Opcode: Stop

Fields #

Name	Description
`MethodName` UnicodeString
`Parameter1` UInt32
`Parameter2` UInt32

Event ID 519: MsaaProviderCalloutStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: MsaaProviderCallout
Opcode: Start

Fields #

Name	Description
`MethodName` UnicodeString
`HWND` HexInt32

Event ID 520: MsaaProviderCalloutStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: MsaaProviderCallout
Opcode: Stop

Fields #

Name	Description
`MethodName` UnicodeString
`HWND` HexInt32

Event ID 521: ClientConnection_DispatchToProviderStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ClientConnection_DispatchToProvider
Opcode: Start

Fields #

Name	Description
`IsChannelConnection` Boolean
`IsCrossMachine` Boolean
`RequestId` UInt32

Event ID 522: ClientConnection_DispatchToProviderStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ClientConnection_DispatchToProvider
Opcode: Stop

Fields #

Name	Description
`IsChannelConnection` Boolean
`IsCrossMachine` Boolean
`RequestId` UInt32

Event ID 523: ProcessIncomingRequestStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ProcessIncomingRequest
Opcode: Start

Fields #

Name	Description
`MethodName` UnicodeString
`ObjectReference` UInt32
`RequestId` UInt32

Event ID 524: ProcessIncomingRequestStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ProcessIncomingRequest
Opcode: Stop

Fields #

Name	Description
`MethodName` UnicodeString
`ObjectReference` UInt32
`RequestId` UInt32

Event ID 525: ProcessIncomingRequest_ContextChangeStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ProcessIncomingRequest_ContextChange
Opcode: Start

Fields #

Name	Description
`InstanceId` UInt32

Event ID 526: ProcessIncomingRequest_ContextChangeStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ProcessIncomingRequest_ContextChange
Opcode: Stop

Fields #

Name	Description
`InstanceId` UInt32

Event ID 527: ServerConnection_OnData_ForceFlush

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ServerConnection_OnData_ForceFlush

Event ID 528: ReleaseCollection_ObjectNotFound

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ReleaseCollection_ObjectNotFound

Event ID 529: ReleaseCollection_ReleaseObjects

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ReleaseCollection_ReleaseObjects

Fields #

Name	Description
`ObjectCount` UInt32
`IsCombinedWithOtherMethod` Boolean

Event ID 530: ReleaseCollection_IncompatibleContext

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ReleaseCollection_IncompatibleContext

Event ID 531: ClientConnection_StateChange

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ClientConnection_StateChange

Fields #

Name	Description
`NewState` UnicodeString

Event ID 532: IsProcessFrozenCheckStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IsProcessFrozenCheck
Opcode: Start

Event ID 533: IsProcessFrozenCheckStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IsProcessFrozenCheck
Opcode: Stop

Event ID 534: ClientConnection_InactiveRequestResponse

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ClientConnection_InactiveRequestResponse

Fields #

Name	Description
`RequestId` UInt32

Event ID 535: ClientConnection_ConnectionTerminated

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ClientConnection_ConnectionTerminated

Fields #

Name	Description
`IsError` Boolean

Event ID 536: EventManager_DoCalldowns_UniversalStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: EventManager_DoCalldowns_Universal
Opcode: Start

Event ID 537: EventManager_DoCalldowns_UniversalStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: EventManager_DoCalldowns_Universal
Opcode: Stop

Fields #

Name	Description
`ProvidersToAdviseCount` UInt32
`RemoteNodesCount` UInt32
`PartialNodesCount` UInt32

Event ID 538: EventManager_DoCalldowns_ClientSideOptimizedStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: EventManager_DoCalldowns_ClientSideOptimized
Opcode: Start

Event ID 539: EventManager_DoCalldowns_ClientSideOptimizedStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: EventManager_DoCalldowns_ClientSideOptimized
Opcode: Stop

Event ID 540: EventManager_CollectNodesToAdviseStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: EventManager_CollectNodesToAdvise
Opcode: Start

Event ID 541: EventManager_CollectNodesToAdviseStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: EventManager_CollectNodesToAdvise
Opcode: Stop

Fields #

Name	Description
`ProvidersToAdviseCount` UInt32
`RemoteNodesCount` UInt32
`PartialNodesCount` UInt32

Event ID 542: EventManager_CollectClientSideItemsToAdviseStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: EventManager_CollectClientSideItemsToAdvise
Opcode: Start

Event ID 543: EventManager_CollectClientSideItemsToAdviseStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: EventManager_CollectClientSideItemsToAdvise
Opcode: Stop

Event ID 544: ClientConnection_RequestWritten

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ClientConnection_RequestWritten

Fields #

Name	Description
`RequestId` UInt32
`PeerProcessId` UInt32
`IsCrossMachine` Boolean
`BytesWritten` UInt32
`RequestTimeout` UInt32
`HRESULT` HexInt32

Event ID 545: ServerConnection_RequestReceived

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ServerConnection_RequestReceived

Fields #

Name	Description
`RequestId` UInt32
`PeerProcessId` UInt32
`BytesReceived` UInt32

Event ID 546: ServerConnection_ResponseWritten

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ServerConnection_ResponseWritten

Fields #

Name	Description
`RequestId` UInt32
`PeerProcessId` UInt32
`BytesWritten` UInt32
`HRESULT` HexInt32

Event ID 547: ClientConnection_ResponseReceived

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ClientConnection_ResponseReceived

Fields #

Name	Description
`RequestId` UInt32
`PeerProcessId` UInt32
`IsCrossMachine` Boolean
`BytesReceived` UInt32

Event ID 603: IA2TextRange_CloneStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_Clone
Opcode: Start

Event ID 604: IA2TextRange_CloneStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_Clone
Opcode: Stop

Event ID 605: IA2TextRange_CompareStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_Compare
Opcode: Start

Event ID 606: IA2TextRange_CompareStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_Compare
Opcode: Stop

Event ID 607: IA2TextRange_CompareEndpointsStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_CompareEndpoints
Opcode: Start

Event ID 608: IA2TextRange_CompareEndpointsStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_CompareEndpoints
Opcode: Stop

Event ID 609: IA2TextRange_ExpandToEnclosingUnitStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_ExpandToEnclosingUnit
Opcode: Start

Event ID 610: IA2TextRange_ExpandToEnclosingUnitStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_ExpandToEnclosingUnit
Opcode: Stop

Event ID 611: IA2TextRange_GetAttributeValueStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_GetAttributeValue
Opcode: Start

Event ID 612: IA2TextRange_GetAttributeValueStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_GetAttributeValue
Opcode: Stop

Event ID 613: IA2TextRange_GetEnclosingElementStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_GetEnclosingElement
Opcode: Start

Event ID 614: IA2TextRange_GetEnclosingElementStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_GetEnclosingElement
Opcode: Stop

Event ID 615: IA2TextRange_GetTextStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_GetText
Opcode: Start

Event ID 616: IA2TextRange_GetTextStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_GetText
Opcode: Stop

Event ID 617: IA2TextRange_MoveStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_Move
Opcode: Start

Event ID 618: IA2TextRange_MoveStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_Move
Opcode: Stop

Event ID 619: IA2TextRange_MoveEndpointByUnitStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_MoveEndpointByUnit
Opcode: Start

Event ID 620: IA2TextRange_MoveEndpointByUnitStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_MoveEndpointByUnit
Opcode: Stop

Event ID 621: IA2TextRange_MoveEndpointByRangeStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_MoveEndpointByRange
Opcode: Start

Event ID 622: IA2TextRange_MoveEndpointByRangeStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_MoveEndpointByRange
Opcode: Stop

Event ID 623: IA2TextRange_GetChildrenStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_GetChildren
Opcode: Start

Event ID 624: IA2TextRange_GetChildrenStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_GetChildren
Opcode: Stop

Event ID 625: IA2TextRange_FindAttributeStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_FindAttribute
Opcode: Start

Event ID 626: IA2TextRange_FindAttributeStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_FindAttribute
Opcode: Stop

Event ID 627: IA2TextRange_FindTextStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_FindText
Opcode: Start

Event ID 628: IA2TextRange_FindTextStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_FindText
Opcode: Stop

Event ID 629: IA2TextRange_GetBoundingRectanglesStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_GetBoundingRectangles
Opcode: Start

Event ID 630: IA2TextRange_GetBoundingRectanglesStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_GetBoundingRectangles
Opcode: Stop

Event ID 631: IA2TextRange_SelectStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_Select
Opcode: Start

Event ID 632: IA2TextRange_SelectStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_Select
Opcode: Stop

Event ID 633: IA2TextRange_AddToSelectionStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_AddToSelection
Opcode: Start

Event ID 634: IA2TextRange_AddToSelectionStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_AddToSelection
Opcode: Stop

Event ID 635: IA2TextRange_RemoveFromSelectionStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_RemoveFromSelection
Opcode: Start

Event ID 636: IA2TextRange_RemoveFromSelectionStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_RemoveFromSelection
Opcode: Stop

Event ID 637: IA2TextRange_ScrollIntoViewStart

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_ScrollIntoView
Opcode: Start

Event ID 638: IA2TextRange_ScrollIntoViewStop

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: IA2TextRange_ScrollIntoView
Opcode: Stop

Event ID 701: ClientConnectionTimeout

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: ClientConnectionTimeout

Fields #

Name	Description
`ProcessName` UnicodeString
`HWND` HexInt32
`WindowClassName` UnicodeString
`RequestedMethod` UnicodeString
`RequestedTimeout` UInt32

Event ID 702: EventOverflow

Provider: Microsoft-Windows-UIAutomationCore
Channel: Perf
Task: EventOverflow

Fields #

Name	Description
`ProcessName` UnicodeString
`HWND` HexInt32
`WindowClassName` UnicodeString
`TotalEvents` UInt32
`EventId` HexInt32
`EventCount` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 820a42d8-38c4-465d-b64e-d7d56ea1d612

Defined in UIAutomationCore.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 7.2.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 7.2.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)