Microsoft-Windows-UserPnp

88 events across 8 channels

Event	Title	Channel	Sample
7550	New device queued up for install.	SchedulerOperations	N
7551	Plug and Play install scheduler has started.	SchedulerOperations	N
7552	Plug and Play install scheduler has exited.	SchedulerOperations	N
7553	Plug and Play install worker thread has started.	SchedulerOperations	N
7554	Plug and Play install worker thread has exited.	SchedulerOperations	N
7555	Parent of current device is already ahead in the install queue.	SchedulerOperations	N
7556	Current device is a volume snapshot device.	SchedulerOperations	N
7600	Client {ClientName} successfully registered for device notifications.	DeviceNotifications	N
7601	Error sending device event notification window message to client {WindowName} …	DeviceNotifications	N
7602	Error sending service control for device event notification to client …	DeviceNotifications	N
7603	Error broadcasting system message for device event notification …	DeviceNotifications	N
7604	Sending notification for event {EventType} for device: {DeviceID}.	DeviceNotifications	N
7650	Received device event from Kernel PnP (GUID={EventGuid}; …	Performance	N
7651	User PnP completed handling of the device event (GUID={EventGuid}; …	Performance	N
7700	Start processing 'DIF_CODE'.	Performance	N
7701	Finished processing 'DIF_CODE' (Err=ErrorCode).	Performance	N
7702	START: Core device install operations.	Performance	N
7703	END: Core device install operations.	Performance	N
7704	ENTER: Synchronization wait for core device install.	Performance	N
7705	EXIT: Synchronization wait for core device install.	Performance	N
7708	ENTER: Stage driver package	Performance	N
7709	EXIT: Stage driver package	Performance	N
7714	ENTER: Sending event notification to service ({ClientName}).	Performance	N
7715	EXIT: Sending event notification to service ({ClientName}).	Performance	N
7716	ENTER: Sending event notification to window ({ClientName}).	Performance	N
7717	EXIT: Sending event notification to window ({ClientName}).	Performance	N
7718	ENTER: Device installation restrictions policy check.	Performance	N
7719	EXIT: Device installation restrictions policy check.	Performance	N
7720	ENTER: Build driver info list.	Performance	N
7721	EXIT: Build driver info list.	Performance	N
7722	ENTER: Build driver info list - search published INFs.	Performance	N
7723	EXIT: Build driver info list - search published INFs.	Performance	N
7724	ENTER: Build driver info list - search Device Path.	Performance	N
7725	EXIT: Build driver info list - search Device Path.	Performance	N
7728	ENTER: Build driver info list - search caller specified folder.	Performance	N
7729	EXIT: Build driver info list - search caller specified folder.	Performance	N
7730	ENTER: PnpInstallDevice - install device instance.	Performance	N
7731	EXIT: PnpInstallDevice - install device instance.	Performance	N
7800	START: Searching WMIS for metadata package	Performance	N
7801	STOP: Searching WMIS for metadata package	Performance	N
7802	START: Downloading metadata package from WMIS	Performance	N
7803	STOP: Downloading metadata package from WMIS	Performance	N
7804	START: Searching local index for metadata package	Performance	N
7805	STOP: Searching local index for metadata package	Performance	N
7806	START: Unpacking metadata package into cache	Performance	N
7807	STOP: Unpacking metadata package into cache	Performance	N
7808	START: Parsing packageinfo.	Performance	N
7809	STOP: Parsing packageinfo.	Performance	N
7810	START: Scanning local store for new metadata packages	Performance	N
7811	STOP: Scanning local store for new metadata packages	Performance	N
7812	START: Initializing DMRC	Performance	N
7813	STOP: Initializing DMRC	Performance	N
7814	START: Uninitialize DMRC	Performance	N
7815	STOP: Uninitializing DMRC	Performance	N
7900	Message (Package: Package Error Code = ErrorCode, Win32 Error Code = …	Debug	N
7901	A new device metadata package was downloaded from WMIS.	Debug	N
7902	Message (Package: Package Error Code = ErrorCode, Win32 Error Code = …	Debug	N
7903	Successfully parsed device metadata file.	Debug	N
7950	A new device metadata package was discovered.	Debug	N
7951	DMRC was queried for type 'QueryType' with lookup key 'LookupKey'.	Debug	N
7952	Message (Error Code = NetworkErrorCode, Last Http Status Code = HttpStatusCode).	Debug	N
8000	A reboot is required to complete device installation of device …	DeviceInstall	Y
8001	The DeviceInstall service has started.	DeviceInstall	Y
8002	The DeviceInstall service is stopping (idle).	DeviceInstall	Y
8003	The DeviceInstall service is stopping (stop control).	DeviceInstall	N
8004	The DeviceInstall service is stopping (shutdown).	DeviceInstall	Y
8005	The DeviceInstall service has stopped.	DeviceInstall	Y
8006	There are pending driver updates to install.	DeviceInstall	N
8007	A timeout was detected during the installation of device 'DeviceId'.	DeviceInstall	N
8008	The DeviceInstall service is starting.	DeviceInstall	Y
8009	The DeviceInstall service failed to start with error ErrorCode.	DeviceInstall	N
8010	Finish install operation state changed to hc_stateid.	ActionCenter	N
8020	Device installation is currently disabled.	DeviceInstall	N
8021	Device installation has been disabled.	DeviceInstall	N
8022	Device installation has been enabled.	DeviceInstall	N
8030	The DeviceInstall service will not idle stop.	DeviceInstall	Y
8040	task_08040	Operational	N
20001	Driver Management concluded the process to install driver http://schemas.	System	Y
20002	Driver Management concluded the process to remove driver DriverName from Device …	System	N
20003	Driver Management has concluded the process to add Service …	System	Y
20004	Driver Management has concluded the process to remove Service ServiceName for …	System	N
20005	Driver Management has restricted the installation of Device Instance ID DeviceId …	System	N
20006	Driver Management has deferred the process to install Device Instance ID …	System	N
20007	Driver Management has removed Device Instance ID DeviceId because of a Device …	System	N
20008	Driver Management has not removed Device Instance ID DeviceId with matching …	System	N
20009	Driver Management will reboot the system in RebootTime seconds to enforce a …	System	N
20010	Event ID 20010	System	Y
20011	Device action request for device '{VetoDevice}' was vetoed by '{VetoName}' with …	System	N

Event ID 7550: New device queued up for install.

Provider: Microsoft-Windows-UserPnp
Channel: SchedulerOperations
Task: PnP_PlugPlay_DeviceInstall

Description

New device queued up for install.

Message #

New device queued up for install.

Fields #

Name	Description
`DeviceId` UnicodeString

Event ID 7551: Plug and Play install scheduler has started.

Provider: Microsoft-Windows-UserPnp
Channel: SchedulerOperations
Task: PnP_PlugPlay_ProcessDeviceInstallBatch
Opcode: Start

Description

Plug and Play install scheduler has started.

Message #

Plug and Play install scheduler has started.

Fields #

Name	Description
`ThreadId` UInt32

Event ID 7552: Plug and Play install scheduler has exited.

Provider: Microsoft-Windows-UserPnp
Channel: SchedulerOperations
Task: PnP_PlugPlay_ProcessDeviceInstallBatch
Opcode: Stop

Description

Plug and Play install scheduler has exited.

Message #

Plug and Play install scheduler has exited.

Fields #

Name	Description
`ThreadId` UInt32

Event ID 7553: Plug and Play install worker thread has started.

Provider: Microsoft-Windows-UserPnp
Channel: SchedulerOperations
Task: PnP_PlugPlay_DeviceInstall

Description

Plug and Play install worker thread has started.

Message #

Plug and Play install worker thread has started.

Fields #

Name	Description
`ThreadId` UInt32
`DeviceId` UnicodeString

Event ID 7554: Plug and Play install worker thread has exited.

Provider: Microsoft-Windows-UserPnp
Channel: SchedulerOperations
Task: PnP_PlugPlay_DeviceInstall

Description

Plug and Play install worker thread has exited.

Message #

Plug and Play install worker thread has exited.

Fields #

Name	Description
`ThreadId` UInt32

Event ID 7555: Parent of current device is already ahead in the install queue.

Provider: Microsoft-Windows-UserPnp
Channel: SchedulerOperations
Task: PnP_PlugPlay_DeviceInstall

Description

Parent of current device is already ahead in the install queue.

Message #

Parent of current device is already ahead in the install queue.

Fields #

Name	Description
`ChildDevice` UnicodeString
`ParentDevice` UnicodeString

Event ID 7556: Current device is a volume snapshot device.

Provider: Microsoft-Windows-UserPnp
Channel: SchedulerOperations
Task: PnP_PlugPlay_DeviceInstall

Description

Current device is a volume snapshot device.

Message #

Current device is a volume snapshot device.

Fields #

Name	Description
`DeviceId` UnicodeString

Event ID 7600: Client {ClientName} successfully registered for device notifications.

Provider: Microsoft-Windows-UserPnp
Channel: DeviceNotifications

Description

Client {ClientName} successfully registered for device notifications.

Message #

Client {ClientName} successfully registered for device notifications.

Fields #

Name	Description
`ClientName`

Event ID 7601: Error sending device event notification window message to client {WindowName} (hWnd={hWnd}; Session={SessionId}; Err={ErrorCode}).

Provider: Microsoft-Windows-UserPnp
Channel: DeviceNotifications

Description

Error sending device event notification window message to client {WindowName} (hWnd={hWnd}; Session={SessionId}; Err={ErrorCode}).

Message #

Error sending device event notification window message to client {WindowName} (hWnd={hWnd}; Session={SessionId}; Err={ErrorCode}).

Fields #

Name	Description
`WindowName`
`hWnd`
`SessionId`
`ErrorCode`

Event ID 7602: Error sending service control for device event notification to client {ClientName} (Session={SessionId}; Err={ErrorCode}).

Provider: Microsoft-Windows-UserPnp
Channel: DeviceNotifications

Description

Error sending service control for device event notification to client {ClientName} (Session={SessionId}; Err={ErrorCode}).

Message #

Error sending service control for device event notification to client {ClientName} (Session={SessionId}; Err={ErrorCode}).

Fields #

Name	Description
`ClientName`
`SessionId`
`ErrorCode`

Event ID 7603: Error broadcasting system message for device event notification (Err={ErrorCode}).

Provider: Microsoft-Windows-UserPnp
Channel: DeviceNotifications

Description

Error broadcasting system message for device event notification (Err={ErrorCode}).

Message #

Error broadcasting system message for device event notification (Err={ErrorCode}).

Fields #

Name	Description
`ErrorCode`

Event ID 7604: Sending notification for event {EventType} for device: {DeviceID}.

Provider: Microsoft-Windows-UserPnp
Channel: DeviceNotifications

Description

Sending notification for event {EventType} for device: {DeviceID}.

Message #

Sending notification for event {EventType} for device: {DeviceID}.

Fields #

Name	Description
`EventType`
`DeviceID`

Event ID 7650: Received device event from Kernel PnP (GUID={EventGuid}; EventCategory={EventCategory}; Async={IsEventAsync}).

Provider: Microsoft-Windows-UserPnp
Channel: Performance

Description

Received device event from Kernel PnP (GUID={EventGuid}; EventCategory={EventCategory}; Async={IsEventAsync}).

Message #

Received device event from Kernel PnP (GUID={EventGuid}; EventCategory={EventCategory}; Async={IsEventAsync}).

Fields #

Name	Description
`EventGuid`
`EventCategory`
`IsEventAsync`

Event ID 7651: User PnP completed handling of the device event (GUID={EventGuid}; EventCategory={EventCategory}; Async={IsEventAsync}).

Provider: Microsoft-Windows-UserPnp
Channel: Performance

Description

User PnP completed handling of the device event (GUID={EventGuid}; EventCategory={EventCategory}; Async={IsEventAsync}).

Message #

User PnP completed handling of the device event (GUID={EventGuid}; EventCategory={EventCategory}; Async={IsEventAsync}).

Fields #

Name	Description
`EventGuid`
`EventCategory`
`IsEventAsync`

Event ID 7700: Start processing 'DIF_CODE'.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_SetupAPI_CallClassInstaller
Opcode: Start

Description

Start processing 'DIF_CODE'.

Message #

Start processing '%1'.

Fields #

Name	Description
`DIF_CODE` UnicodeString
`ErrorCode` HexInt32

Event ID 7701: Finished processing 'DIF_CODE' (Err=ErrorCode).

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_SetupAPI_CallClassInstaller
Opcode: Stop

Description

Finished processing 'DIF_CODE' (Err=ErrorCode).

Message #

Finished processing '%1' (Err=%2).

Fields #

Name	Description
`DIF_CODE` UnicodeString
`ErrorCode` HexInt32

Event ID 7702: START: Core device install operations.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_Drvinst_ProcessCoreDeviceInstall
Opcode: Start

Description

START: Core device install operations.

Message #

START: Core device install operations.

Event ID 7703: END: Core device install operations.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_Drvinst_ProcessCoreDeviceInstall
Opcode: Stop

Description

END: Core device install operations.

Message #

END: Core device install operations.

Event ID 7704: ENTER: Synchronization wait for core device install.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_Drvinst_WaitCoreInstallMutex
Opcode: Start

Description

ENTER: Synchronization wait for core device install.

Message #

ENTER: Synchronization wait for core device install.

Event ID 7705: EXIT: Synchronization wait for core device install.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_Drvinst_WaitCoreInstallMutex
Opcode: Stop

Description

EXIT: Synchronization wait for core device install.

Message #

EXIT: Synchronization wait for core device install.

Event ID 7708: ENTER: Stage driver package

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_SetupAPI_StageDriverPackage
Opcode: Start

Description

ENTER: Stage driver package.

Message #

ENTER: Stage driver package

Event ID 7709: EXIT: Stage driver package

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_SetupAPI_StageDriverPackage
Opcode: Stop

Description

EXIT: Stage driver package.

Message #

EXIT: Stage driver package

Event ID 7714: ENTER: Sending event notification to service ({ClientName}).

Provider: Microsoft-Windows-UserPnp
Channel: Performance

Description

ENTER: Sending event notification to service ({ClientName}).

Message #

ENTER: Sending event notification to service ({ClientName}).

Fields #

Name	Description
`ClientName`

Event ID 7715: EXIT: Sending event notification to service ({ClientName}).

Provider: Microsoft-Windows-UserPnp
Channel: Performance

Description

EXIT: Sending event notification to service ({ClientName}).

Message #

EXIT: Sending event notification to service ({ClientName}).

Fields #

Name	Description
`ClientName`

Event ID 7716: ENTER: Sending event notification to window ({ClientName}).

Provider: Microsoft-Windows-UserPnp
Channel: Performance

Description

ENTER: Sending event notification to window ({ClientName}).

Message #

ENTER: Sending event notification to window ({ClientName}).

Fields #

Name	Description
`ClientName`

Event ID 7717: EXIT: Sending event notification to window ({ClientName}).

Provider: Microsoft-Windows-UserPnp
Channel: Performance

Description

EXIT: Sending event notification to window ({ClientName}).

Message #

EXIT: Sending event notification to window ({ClientName}).

Fields #

Name	Description
`ClientName`

Event ID 7718: ENTER: Device installation restrictions policy check.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_Drvinst_DevicePolicyCheck
Opcode: Start

Description

ENTER: Device installation restrictions policy check.

Message #

ENTER: Device installation restrictions policy check.

Event ID 7719: EXIT: Device installation restrictions policy check.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_Drvinst_DevicePolicyCheck
Opcode: Stop

Description

EXIT: Device installation restrictions policy check.

Message #

EXIT: Device installation restrictions policy check.

Event ID 7720: ENTER: Build driver info list.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_SetupAPI_BuildDriverInfoList
Opcode: Start

Description

ENTER: Build driver info list.

Message #

ENTER: Build driver info list.

Event ID 7721: EXIT: Build driver info list.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_SetupAPI_BuildDriverInfoList
Opcode: Stop

Description

EXIT: Build driver info list.

Message #

EXIT: Build driver info list.

Event ID 7722: ENTER: Build driver info list - search published INFs.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_SetupAPI_PublishedInfDriverSearch
Opcode: Start

Description

ENTER: Build driver info list - search published INFs.

Message #

ENTER: Build driver info list - search published INFs.

Event ID 7723: EXIT: Build driver info list - search published INFs.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_SetupAPI_PublishedInfDriverSearch
Opcode: Stop

Description

EXIT: Build driver info list - search published INFs.

Message #

EXIT: Build driver info list - search published INFs.

Event ID 7724: ENTER: Build driver info list - search Device Path.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_SetupAPI_DevicePathDriverSearch
Opcode: Start

Description

ENTER: Build driver info list - search Device Path.

Message #

ENTER: Build driver info list - search Device Path.

Event ID 7725: EXIT: Build driver info list - search Device Path.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_SetupAPI_DevicePathDriverSearch
Opcode: Stop

Description

EXIT: Build driver info list - search Device Path.

Message #

EXIT: Build driver info list - search Device Path.

Event ID 7728: ENTER: Build driver info list - search caller specified folder.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_SetupAPI_FolderDriverSearch
Opcode: Start

Description

ENTER: Build driver info list - search caller specified folder.

Message #

ENTER: Build driver info list - search caller specified folder.

Event ID 7729: EXIT: Build driver info list - search caller specified folder.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_SetupAPI_FolderDriverSearch
Opcode: Stop

Description

EXIT: Build driver info list - search caller specified folder.

Message #

EXIT: Build driver info list - search caller specified folder.

Event ID 7730: ENTER: PnpInstallDevice - install device instance.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_PlugPlay_PnpInstallDevice
Opcode: Start

Description

ENTER: PnpInstallDevice - install device instance.

Message #

ENTER: PnpInstallDevice - install device instance.

Event ID 7731: EXIT: PnpInstallDevice - install device instance.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_PlugPlay_PnpInstallDevice
Opcode: Stop

Description

EXIT: PnpInstallDevice - install device instance.

Message #

EXIT: PnpInstallDevice - install device instance.

Event ID 7800: START: Searching WMIS for metadata package

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_DMRC_SearchWMIS
Opcode: Start

Description

START: Searching WMIS for metadata package.

Message #

START: Searching WMIS for metadata package

Event ID 7801: STOP: Searching WMIS for metadata package

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_DMRC_SearchWMIS
Opcode: Stop

Description

STOP: Searching WMIS for metadata package.

Message #

STOP: Searching WMIS for metadata package

Event ID 7802: START: Downloading metadata package from WMIS

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_DMRC_DownloadPackage
Opcode: Start

Description

START: Downloading metadata package from WMIS.

Message #

START: Downloading metadata package from WMIS

Event ID 7803: STOP: Downloading metadata package from WMIS

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_DMRC_DownloadPackage
Opcode: Stop

Description

STOP: Downloading metadata package from WMIS.

Message #

STOP: Downloading metadata package from WMIS

Event ID 7804: START: Searching local index for metadata package

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_DMRC_SearchLocalIndex
Opcode: Start

Description

START: Searching local index for metadata package.

Message #

START: Searching local index for metadata package

Event ID 7805: STOP: Searching local index for metadata package

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_DMRC_SearchLocalIndex
Opcode: Stop

Description

STOP: Searching local index for metadata package.

Message #

STOP: Searching local index for metadata package

Event ID 7806: START: Unpacking metadata package into cache

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_DMRC_UnpackPackage
Opcode: Start

Description

START: Unpacking metadata package into cache.

Message #

START: Unpacking metadata package into cache

Event ID 7807: STOP: Unpacking metadata package into cache

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_DMRC_UnpackPackage
Opcode: Stop

Description

STOP: Unpacking metadata package into cache.

Message #

STOP: Unpacking metadata package into cache

Event ID 7808: START: Parsing packageinfo.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_DMRC_ParsePackageInfo
Opcode: Start

Description

START: Parsing packageinfo.xml for metadata properties.

Message #

START: Parsing packageinfo.xml for metadata properties

Event ID 7809: STOP: Parsing packageinfo.

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_DMRC_ParsePackageInfo
Opcode: Stop

Description

STOP: Parsing packageinfo.xml for metadata properties.

Message #

STOP: Parsing packageinfo.xml for metadata properties

Event ID 7810: START: Scanning local store for new metadata packages

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_DMRC_ScanLocalStore
Opcode: Start

Description

START: Scanning local store for new metadata packages.

Message #

START: Scanning local store for new metadata packages

Event ID 7811: STOP: Scanning local store for new metadata packages

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_DMRC_ScanLocalStore
Opcode: Stop

Description

STOP: Scanning local store for new metadata packages.

Message #

STOP: Scanning local store for new metadata packages

Event ID 7812: START: Initializing DMRC

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_DMRC_Initialize
Opcode: Start

Description

START: Initializing DMRC.

Message #

START: Initializing DMRC

Event ID 7813: STOP: Initializing DMRC

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_DMRC_Initialize
Opcode: Stop

Description

STOP: Initializing DMRC.

Message #

STOP: Initializing DMRC

Event ID 7814: START: Uninitialize DMRC

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_DMRC_Uninitialize
Opcode: Start

Description

START: Uninitialize DMRC.

Message #

START: Uninitialize DMRC

Event ID 7815: STOP: Uninitializing DMRC

Provider: Microsoft-Windows-UserPnp
Channel: Performance
Task: PnP_DMRC_Uninitialize
Opcode: Stop

Description

STOP: Uninitializing DMRC.

Message #

STOP: Uninitializing DMRC

Event ID 7900: Message (Package: Package Error Code = ErrorCode, Win32 Error Code = Win32ErrorCode).

Provider: Microsoft-Windows-UserPnp
Channel: Debug
Task: PnP_DMRC_ParseMetadata

Description

Message (Package: Package Error Code = ErrorCode, Win32 Error Code = Win32ErrorCode).

Message #

%1 (Package: %2 Error Code = %3, Win32 Error Code = %4)

Fields #

Name	Description
`Message` UnicodeString
`Package` UnicodeString
`ErrorCode` HexInt32
`Win32ErrorCode` HexInt32

Event ID 7901: A new device metadata package was downloaded from WMIS.

Provider: Microsoft-Windows-UserPnp
Channel: Debug
Task: PnP_DMRC_Query

Description

A new device metadata package was downloaded from WMIS. (Path: PackagePath).

Message #

A new device metadata package was downloaded from WMIS. (Path: %1)

Fields #

Name	Description
`PackagePath` UnicodeString

Event ID 7902: Message (Package: Package Error Code = ErrorCode, Win32 Error Code = Win32ErrorCode).

Provider: Microsoft-Windows-UserPnp
Channel: Debug
Task: PnP_DMRC_ParseMetadata

Description

Message (Package: Package Error Code = ErrorCode, Win32 Error Code = Win32ErrorCode).

Message #

%1 (Package: %2 Error Code = %3, Win32 Error Code = %4)

Fields #

Name	Description
`Message` UnicodeString
`Package` UnicodeString
`ErrorCode` HexInt32
`Win32ErrorCode` HexInt32

Event ID 7903: Successfully parsed device metadata file.

Provider: Microsoft-Windows-UserPnp
Channel: Debug
Task: PnP_DMRC_ParseMetadata

Description

Successfully parsed device metadata file. (File: File, Language: Language).

Message #

Successfully parsed device metadata file. (File: %1, Language: %2)

Fields #

Name	Description
`File` UnicodeString
`Language` UnicodeString

Event ID 7950: A new device metadata package was discovered.

Provider: Microsoft-Windows-UserPnp
Channel: Debug
Task: PnP_DMRC_ParseMetadata

Description

A new device metadata package was discovered. (Package Name: PackageName, Path: PackagePath).

Message #

A new device metadata package was discovered. (Package Name: %1, Path: %2)

Fields #

Name	Description
`PackageName` UnicodeString
`PackagePath` UnicodeString

Event ID 7951: DMRC was queried for type 'QueryType' with lookup key 'LookupKey'.

Provider: Microsoft-Windows-UserPnp
Channel: Debug
Task: PnP_DMRC_Query

Description

DMRC was queried for type 'QueryType' with lookup key 'LookupKey'.

Message #

DMRC was queried for type '%1' with lookup key '%2'

Fields #

Name	Description
`QueryType` UnicodeString
`LookupKey` UnicodeString

Event ID 7952: Message (Error Code = NetworkErrorCode, Last Http Status Code = HttpStatusCode).

Provider: Microsoft-Windows-UserPnp
Channel: Debug
Task: PnP_DMRC_Query

Description

Message (Error Code = NetworkErrorCode, Last Http Status Code = HttpStatusCode).

Message #

%1 (Error Code = %2, Last Http Status Code = %3)

Fields #

Name	Description
`Message` UnicodeString
`NetworkErrorCode` HexInt32
`HttpStatusCode` UInt32

Event ID 8000: A reboot is required to complete device installation of device 'ERR_DEVICE_ID.DeviceId'.

Provider: Microsoft-Windows-UserPnp
Channel: DeviceInstall
Level: Warning

Description

A reboot is required to complete device installation of device 'ERR_DEVICE_ID.DeviceId'.

Message #

A reboot is required to complete device installation of device '%1'

Fields #

Name	Description
`DeviceId`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-UserPnp",
    "guid": "96F4A050-7E31-453C-88BE-9634F4E02139",
    "event_source_name": "",
    "event_id": 8000,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 576460752303423490,
    "time_created": "2023-10-25T22:50:39.873740+00:00",
    "event_record_id": 21,
    "correlation": {},
    "execution": {
      "process_id": 3600,
      "thread_id": 1060
    },
    "channel": "Microsoft-Windows-UserPnp/DeviceInstall",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "ERR_DEVICE_ID": {
      "DeviceId": "ACPI\\VMW0003\\4&1BD7F811&0"
    }
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 8001: The DeviceInstall service has started.

Provider: Microsoft-Windows-UserPnp
Channel: DeviceInstall
Level: Informational

Description

The DeviceInstall service has started.

Message #

The DeviceInstall service has started.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-UserPnp",
    "guid": "{96F4A050-7E31-453C-88BE-9634F4E02139}",
    "event_source_name": "",
    "event_id": 8001,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 576460752303423490,
    "time_created": "2026-05-28T04:47:58.4674435+00:00",
    "event_record_id": 13,
    "correlation": {},
    "execution": {
      "process_id": 4536,
      "thread_id": 5956
    },
    "channel": "Microsoft-Windows-UserPnp/DeviceInstall",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "The DeviceInstall service has started."
}

Event ID 8002: The DeviceInstall service is stopping (idle).

Provider: Microsoft-Windows-UserPnp
Channel: DeviceInstall
Level: Informational

Description

The DeviceInstall service is stopping (idle).

Message #

The DeviceInstall service is stopping (idle).

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-UserPnp",
    "guid": "{96F4A050-7E31-453C-88BE-9634F4E02139}",
    "event_source_name": "",
    "event_id": 8002,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 576460752303423490,
    "time_created": "2026-05-28T04:50:31.7833993+00:00",
    "event_record_id": 14,
    "correlation": {},
    "execution": {
      "process_id": 4536,
      "thread_id": 2572
    },
    "channel": "Microsoft-Windows-UserPnp/DeviceInstall",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "The DeviceInstall service is stopping (idle)."
}

Event ID 8003: The DeviceInstall service is stopping (stop control).

Provider: Microsoft-Windows-UserPnp
Channel: DeviceInstall

Description

The DeviceInstall service is stopping (stop control).

Message #

The DeviceInstall service is stopping (stop control).

Event ID 8004: The DeviceInstall service is stopping (shutdown).

Provider: Microsoft-Windows-UserPnp
Channel: DeviceInstall
Level: Informational

Description

The DeviceInstall service is stopping (shutdown).

Message #

The DeviceInstall service is stopping (shutdown).

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-UserPnp",
    "guid": "96F4A050-7E31-453C-88BE-9634F4E02139",
    "event_source_name": "",
    "event_id": 8004,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 576460752303423490,
    "time_created": "2023-11-06T06:23:40.089953+00:00",
    "event_record_id": 27,
    "correlation": {},
    "execution": {
      "process_id": 1068,
      "thread_id": 1072
    },
    "channel": "Microsoft-Windows-UserPnp/DeviceInstall",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 8005: The DeviceInstall service has stopped.

Provider: Microsoft-Windows-UserPnp
Channel: DeviceInstall
Level: Informational

Description

The DeviceInstall service has stopped.

Message #

The DeviceInstall service has stopped.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-UserPnp",
    "guid": "{96F4A050-7E31-453C-88BE-9634F4E02139}",
    "event_source_name": "",
    "event_id": 8005,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 576460752303423490,
    "time_created": "2026-05-28T04:50:31.7839977+00:00",
    "event_record_id": 15,
    "correlation": {},
    "execution": {
      "process_id": 4536,
      "thread_id": 2572
    },
    "channel": "Microsoft-Windows-UserPnp/DeviceInstall",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "The DeviceInstall service has stopped."
}

Event ID 8006: There are pending driver updates to install.

Provider: Microsoft-Windows-UserPnp
Channel: DeviceInstall

Description

There are pending driver updates to install.

Message #

There are pending driver updates to install.

Event ID 8007: A timeout was detected during the installation of device 'DeviceId'.

Provider: Microsoft-Windows-UserPnp
Channel: DeviceInstall

Description

A timeout was detected during the installation of device 'DeviceId'.

Message #

A timeout was detected during the installation of device '%1'

Fields #

Name	Description
`DeviceId` UnicodeString

Event ID 8008: The DeviceInstall service is starting.

Provider: Microsoft-Windows-UserPnp
Channel: DeviceInstall
Level: Informational

Description

The DeviceInstall service is starting.

Message #

The DeviceInstall service is starting.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-UserPnp",
    "guid": "96F4A050-7E31-453C-88BE-9634F4E02139",
    "event_source_name": "",
    "event_id": 8008,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 576460752303423490,
    "time_created": "2023-11-06T06:25:29.340577+00:00",
    "event_record_id": 29,
    "correlation": {},
    "execution": {
      "process_id": 1080,
      "thread_id": 1096
    },
    "channel": "Microsoft-Windows-UserPnp/DeviceInstall",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 8009: The DeviceInstall service failed to start with error ErrorCode.

Provider: Microsoft-Windows-UserPnp
Channel: DeviceInstall

Description

The DeviceInstall service failed to start with error ErrorCode.

Message #

The DeviceInstall service failed to start with error %1.

Fields #

Name	Description
`ErrorCode` HexInt32

Event ID 8010: Finish install operation state changed to hc_stateid.

Provider: Microsoft-Windows-UserPnp
Channel: ActionCenter
Task: FinishInstallOperationsstatehaschanged.

Description

Finish install operation state changed to hc_stateid.

Message #

Finish install operation state changed to %1.

Fields #

Name	Description
`hc_stateid` UInt32

Event ID 8020: Device installation is currently disabled.

Provider: Microsoft-Windows-UserPnp
Channel: DeviceInstall

Description

Device installation is currently disabled.

Message #

Device installation is currently disabled.

Event ID 8021: Device installation has been disabled.

Provider: Microsoft-Windows-UserPnp
Channel: DeviceInstall

Description

Device installation has been disabled.

Message #

Device installation has been disabled.

Event ID 8022: Device installation has been enabled.

Provider: Microsoft-Windows-UserPnp
Channel: DeviceInstall

Description

Device installation has been enabled.

Message #

Device installation has been enabled.

Event ID 8030: The DeviceInstall service will not idle stop.

Provider: Microsoft-Windows-UserPnp
Channel: DeviceInstall
Level: Informational

Description

The DeviceInstall service will not idle stop.

Message #

The DeviceInstall service will not idle stop.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-UserPnp",
    "guid": "96F4A050-7E31-453C-88BE-9634F4E02139",
    "event_source_name": "",
    "event_id": 8030,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 576460752303423490,
    "time_created": "2023-11-06T06:25:29.352092+00:00",
    "event_record_id": 31,
    "correlation": {},
    "execution": {
      "process_id": 1080,
      "thread_id": 1096
    },
    "channel": "Microsoft-Windows-UserPnp/DeviceInstall",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 8040: task_08040

Provider: Microsoft-Windows-UserPnp
Channel: Operational

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`HardwareIds` UnicodeString
`CompatibleIds` UnicodeString
`MatchingDeviceId` UnicodeString
`OriginalInfName` UnicodeString
`DriverDate` FILETIME
`DriverVersion` UnicodeString
`SubmissionId` UnicodeString
`FlightIds` UnicodeString

Event ID 20001: Driver Management concluded the process to install driver http://schemas.

Provider: Microsoft-Windows-UserPnp
Channel: System
Level: Informational
Task: PnP_PlugPlay_DeviceInstall

Description

Driver Management concluded the process to install driver for Device Instance ID with the following status: .

Message #

Driver Management concluded the process to install driver %1 for Device Instance ID %4 with the following status: %9.

Fields #

Name	Description
`DriverName`
`DriverVersion`
`DriverProvider`
`DeviceInstanceID`
`SetupClass`
`RebootOption`
`UpgradeDevice`
`IsDriverOEM`
`InstallStatus`
`DriverDescription`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-UserPnp",
    "guid": "96F4A050-7E31-453C-88BE-9634F4E02139",
    "event_source_name": "",
    "event_id": 20001,
    "version": 0,
    "level": 4,
    "task": 7005,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2013-10-23T16:17:53.968750+00:00",
    "event_record_id": 250,
    "correlation": {},
    "execution": {
      "process_id": 1536,
      "thread_id": 1900
    },
    "channel": "System",
    "computer": "37L4247D28-05",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "InstallDeviceID": {
      "xmlns:auto-ns2": "http://schemas.microsoft.com/win/2004/08/events",
      "DriverName": "FileRepository\\rdpbus.inf_x86_neutral_27637529205407be\\rdpbus.inf",
      "DriverVersion": "6.1.7600.16385",
      "DriverProvider": "Microsoft",
      "DeviceInstanceID": "ROOT\\RDPBUS\\0000",
      "SetupClass": "4D36E97D-E325-11CE-BFC1-08002BE10318",
      "RebootOption": false,
      "UpgradeDevice": false,
      "IsDriverOEM": false,
      "InstallStatus": 0,
      "DriverDescription": "Remote Desktop Device Redirector Bus"
    }
  },
  "message": "Driver Management concluded the process to install driver http://schemas.microsoft.com/win/2004/08/events for Device Instance ID Microsoft with the following status: false."
}

References #

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 20002: Driver Management concluded the process to remove driver DriverName from Device Instance ID DeviceInstanceID with the following status: InstallStatus.

Provider: Microsoft-Windows-UserPnp
Channel: System
Task: PnP_PlugPlay_DeviceInstall

Description

Driver Management concluded the process to remove driver DriverName from Device Instance ID DeviceInstanceID with the following status: InstallStatus.

Message #

Driver Management concluded the process to remove driver %1 from Device Instance ID %4 with the following status: %9.

Fields #

Name	Description
`DriverName` UnicodeString
`DriverVersion` UnicodeString
`DriverProvider` UnicodeString
`DeviceInstanceID` UnicodeString
`SetupClass` GUID
`RebootOption` Boolean
`UpgradeDevice` Boolean
`IsDriverOEM` Boolean
`InstallStatus` HexInt32
`DriverDescription` UnicodeString

Event ID 20003: Driver Management has concluded the process to add Service AddServiceID.ServiceName for Device Instance ID AddServiceID.DeviceInstanceID with the following status: AddServiceID.AddServiceStatus.

Provider: Microsoft-Windows-UserPnp
Channel: System
Level: Informational
Task: PnP_PlugPlay_DeviceInstall

Description

Driver Management has concluded the process to add Service AddServiceID.ServiceName for Device Instance ID AddServiceID.DeviceInstanceID with the following status: AddServiceID.AddServiceStatus.

Message #

Driver Management has concluded the process to add Service %1 for Device Instance ID %3 with the following status: %6.

Fields #

Name	Description
`ServiceName`
`DriverFileName`
`DeviceInstanceID`
`PrimaryService`
`UpdateService`
`AddServiceStatus`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-UserPnp",
    "guid": "96F4A050-7E31-453C-88BE-9634F4E02139",
    "event_source_name": "",
    "event_id": 20003,
    "version": 0,
    "level": 4,
    "task": 7005,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-05T22:30:40.551666+00:00",
    "event_record_id": 1844,
    "correlation": {},
    "execution": {
      "process_id": 7864,
      "thread_id": 8460
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "AddServiceID": {
      "ServiceName": "VM3DService",
      "DriverFileName": "%SystemRoot%\\system32\\vm3dservice.exe",
      "DeviceInstanceID": "PCI\\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\\3&61AAA01&0&78",
      "PrimaryService": false,
      "UpdateService": false,
      "AddServiceStatus": 0
    }
  },
  "message": ""
}

References #

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 20004: Driver Management has concluded the process to remove Service ServiceName for Device Instance ID DeviceInstanceID with the following status: AddServiceStatus.

Provider: Microsoft-Windows-UserPnp
Channel: System
Task: PnP_PlugPlay_DeviceInstall

Description

Driver Management has concluded the process to remove Service ServiceName for Device Instance ID DeviceInstanceID with the following status: AddServiceStatus.

Message #

Driver Management has concluded the process to remove Service %1 for Device Instance ID %3 with the following status: %6.

Fields #

Name	Description
`ServiceName` UnicodeString
`DriverFileName` UnicodeString
`DeviceInstanceID` UnicodeString
`PrimaryService` Boolean
`UpdateService` Boolean
`AddServiceStatus` UInt32

Event ID 20005: Driver Management has restricted the installation of Device Instance ID DeviceId because of a Device Installation Restriction policy setting.

Provider: Microsoft-Windows-UserPnp
Channel: System
Task: PnP_PlugPlay_DeviceInstall

Description

Driver Management has restricted the installation of Device Instance ID DeviceId because of a Device Installation Restriction policy setting.

Message #

Driver Management has restricted the installation of Device Instance ID %1 because of a Device Installation Restriction policy setting.

Fields #

Name	Description
`DeviceId` UnicodeString

Event ID 20006: Driver Management has deferred the process to install Device Instance ID DeviceId until a driver has been selected because of a Device Installation Restr...

Provider: Microsoft-Windows-UserPnp
Channel: System
Task: PnP_PlugPlay_DeviceInstall

Description

Driver Management has deferred the process to install Device Instance ID DeviceId until a driver has been selected because of a Device Installation Restriction policy setting.

Message #

Driver Management has deferred the process to install Device Instance ID %1 until a driver has been selected because of a Device Installation Restriction policy setting.

Fields #

Name	Description
`DeviceId` UnicodeString

Event ID 20007: Driver Management has removed Device Instance ID DeviceId because of a Device Installation Restriction policy setting.

Provider: Microsoft-Windows-UserPnp
Channel: System
Task: PnP_PlugPlay_DeviceInstall

Description

Driver Management has removed Device Instance ID DeviceId because of a Device Installation Restriction policy setting.

Message #

Driver Management has removed Device Instance ID %1 because of a Device Installation Restriction policy setting.

Fields #

Name	Description
`DeviceId` UnicodeString

Event ID 20008: Driver Management has not removed Device Instance ID DeviceId with matching policy restriction because it is a required system device.

Provider: Microsoft-Windows-UserPnp
Channel: System
Task: PnP_PlugPlay_DeviceInstall

Description

Driver Management has not removed Device Instance ID DeviceId with matching policy restriction because it is a required system device.

Message #

Driver Management has not removed Device Instance ID %1 with matching policy restriction because it is a required system device.

Fields #

Name	Description
`DeviceId` UnicodeString

Event ID 20009: Driver Management will reboot the system in RebootTime seconds to enforce a Device Installation Restriction policy setting.

Provider: Microsoft-Windows-UserPnp
Channel: System
Task: PnP_PlugPlay_DeviceInstall

Description

Driver Management will reboot the system in RebootTime seconds to enforce a Device Installation Restriction policy setting.

Message #

Driver Management will reboot the system in %1 seconds to enforce a Device Installation Restriction policy setting.

Fields #

Name	Description
`RebootTime` UInt32

Event ID 20010

Provider: Microsoft-Windows-UserPnp
Channel: System
Level: Informational

Fields #

Name	Description
`INFO_PNP_STATE.xmlns:auto-ns2`
`INFO_PNP_STATE.InstallSubsystemState`
`INFO_PNP_STATE.CachingSubsystemState`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-UserPnp",
    "guid": "96F4A050-7E31-453C-88BE-9634F4E02139",
    "event_source_name": "",
    "event_id": 20010,
    "version": 0,
    "level": 4,
    "task": 7010,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2013-10-23T16:18:04.750000+00:00",
    "event_record_id": 255,
    "correlation": {},
    "execution": {
      "process_id": 616,
      "thread_id": 1644
    },
    "channel": "System",
    "computer": "37L4247D28-05",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "INFO_PNP_STATE": {
      "xmlns:auto-ns2": "http://schemas.microsoft.com/win/2004/08/events",
      "InstallSubsystemState": true,
      "CachingSubsystemState": true
    }
  },
  "message": ""
}

References #

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 20011: Device action request for device '{VetoDevice}' was vetoed by '{VetoName}' with veto type {VetoType}.

Provider: Microsoft-Windows-UserPnp
Channel: System

Description

Device action request for device '{VetoDevice}' was vetoed by '{VetoName}' with veto type {VetoType}.

Message #

Device action request for device '{VetoDevice}' was vetoed by '{VetoName}' with veto type {VetoType}.

Fields #

Name	Description
`VetoDevice`
`VetoName`
`VetoType`

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 96f4a050-7e31-453c-88be-9634f4e02139

Defined in umpnpmgr.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)